Convex Backend

• Verdict: Pass
• Confidence: High
• Analyzed: Mar 3, 2026, 7:48 PM
• Findings: 0
• Version: 1.0.4

Overview

The skill's requests, files, and runtime instructions match its stated purpose (using a Convex backend for secrets, memory, and logs); nothing in the package appears to be doing unrelated or hidden actions.

This package is coherent with its purpose, but be aware of the operational implications before installing: - CONVEX_DEPLOY_KEY is powerful: it allows deploying code into your Convex project. Only provide a deploy key you trust and scope it appropriately (use a development key or least-privilege credentials if possible). - Review the convex/ source files included in the skill before running the deploy step to ensure they match what you expect (the package includes the functions that will be deployed). - Follow the SKILL.md rules: never store CONVEX_DEPLOY_KEY inside Convex, require explicit approval before destructive migrations (Phase B), and verify env migration results. - If you do not want the agent to be able to deploy code autonomously, do not place the deploy key in an environment the agent can use without manual approval; instead run deploy steps yourself. - If you are uncomfortable granting deploy rights, you can still use Convex manually (deploy the included app yourself) and then provide only runtime access that is limited to reading/writing data rather than deploying new functions.