# Convex Migrate

> Convex Migrate is an officially published skill from get-convex. Anomity scores its risk at 35 out of 100 (medium). It matches 1 dangerous capability combination.

- **Canonical URL:** https://catalog.anomity.ai/skill/convex-migrate
- **Kind:** Skill
- **Publisher:** get-convex
- **Trust level:** official
- **Risk score:** 35/100 (medium)
- **Website:** https://www.convex.dev
- **Last updated:** 2026-09-02
- **JSON:** https://catalog.anomity.ai/api/entries/skill/convex-migrate

## Description

Performs schema migration and data backfill on deployed Convex applications, with a companion rehearsal skill that tests the same change against a snapshot before it is promoted.

Declared capabilities are database read and write plus outbound network access. Schema migration is among the least reversible things an agent can do to a system, which is exactly why the rehearse-then-promote split matters — it is the pattern to copy in any agent workflow that touches production data. Run the rehearsal, read its output, then promote deliberately.

## Why it scored 35

The score starts at the catalog's neutral base of 50 and moves only through the signals below. The formula is published at https://catalog.anomity.ai/about — there is no model and no hidden heuristic.

| Signal | Contribution | Severity | Evidence |
| --- | --- | --- | --- |
| Published by the vendor | -40 | trust offset |  |
| 1 high-risk capability: database:write | +10 | high |  |
| Database exfiltration risk (high) | +15 | high | Database read combined with outbound network can exfiltrate production data. |

Clamped result: **35/100**, band **medium**.

## Capabilities

| Capability | Name | Security implication |
| --- | --- | --- |
| `database:read` | Database read | Reads from connected databases. Useful for query and analytics agents; risky when combined with outbound network. |
| `database:write` | Database write | Writes to connected databases. High-impact; combined with outbound network is treated as exfiltration-class. |
| `network:outbound` | Outbound network | Can make outbound network requests. Required for hosted model providers and remote APIs; also the path for data exfiltration if combined with read access. |

## Dangerous combinations matched

### Database exfiltration risk (high)

Database read combined with outbound network can exfiltrate production data.

Capabilities: `database:read`, `network:outbound`

## Related skills

- [AI Research Reproduction](https://catalog.anomity.ai/skill/ai-research-reproduction) — risk 100 (critical)
- [Browser Act](https://catalog.anomity.ai/skill/browser-act) — risk 95 (critical)
- [Anti-Detect Browser](https://catalog.anomity.ai/skill/anti-detect-browser) — risk 70 (high)
- [Azure Deploy](https://catalog.anomity.ai/skill/azure-deploy) — risk 45 (medium)
- [Azure Diagnostics](https://catalog.anomity.ai/skill/azure-diagnostics) — risk 45 (medium)
- [AI SEO](https://catalog.anomity.ai/skill/ai-seo) — risk 40 (medium)

---

Source: Anomity Catalog (https://catalog.anomity.ai/). Scoring methodology: https://catalog.anomity.ai/about. Machine-readable index: https://catalog.anomity.ai/llms.txt · https://catalog.anomity.ai/openapi.json