📦
Historial de auditorías
convex-expert - 1 auditoría
Versión de auditoría 1 Más reciente
7 sept 2026, 13:53
Most detections are Markdown backticks around API names, not shell execution. The verification rule does execute project tools and can deploy code or rewrite local Convex configuration without explicit approval.
1
Archivos escaneados
39
Líneas analizadas
5
Elementos de revisión
0
Falsos positivos ignorados
Preocupaciones de seguridad confirmadas (3)
Alto
Environment file access
- SELF-VERIFY RULE — before declaring backend work done, verify it compiles and pushes: run `npx tsc
The text acknowledges that the anonymous Convex command can rebind .env.local. This is a concrete local environment configuration change.
Alto
Environment variant files
- SELF-VERIFY RULE — before declaring backend work done, verify it compiles and pushes: run `npx tsc
The workflow conditionally enables anonymous mode and states that this operation can rewrite .env.local. That creates a direct environment-file integrity risk.
Alto
Deployment Without Explicit Approval
The skill requires pushing changes and permits anonymous deployment creation. This can upload project code and alter cloud state without explicit user confirmation.
Line 38 directly requires a successful push and provides commands for authenticated or anonymous deployment. No confirmation step is specified.
Elementos de revisión de capacidades (1)
Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.
Medio
Ruby/shell backtick execution
- SELF-VERIFY RULE — before declaring backend work done, verify it compiles and pushes: run `npx tsc
The line explicitly directs the agent to run npx commands and push backend changes to a deployment. These commands can execute project tooling and change local or remote state.
Factores de riesgo
⚙️ Comandos externos (8)
Auditado por: codex