convex-improve-convex-plugin

SUSPICIOUS. The stated purpose matches the capability, and evidence suggests this is an official Convex workflow rather than outright malware. But the skill still asks the agent to execute an unpinned remote shell script and trust that script to locate, redact, and upload the full session transcript, so the security risk is medium due to remote-code execution and off-device transcript forwarding.