add

SUSPICIOUS. The skill's purpose broadly matches its behavior, and the Convex-hosted catalog/docs appear same-org and documented, but the fallback remote-script execution via curl|bash is a high-risk supply-chain pattern. Risk is driven more by mutable remote install/procedure trust than by confirmed credential theft or overt malicious intent.