improve-convex-plugin

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (medium risk: 0.30). The skill instructs the agent to download and execute an arbitrary script from a remote Convex site via curl and bash.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill fetches and executes an arbitrary remote script via curl piped to bash from a third-party site (basic-anteater-667.convex.site), introducing an unverifiable runtime external dependency with weak/unknown provenance.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill prompt instructs the agent to download and execute an arbitrary shell script from a remote URL via curl piped to bash, which poses a severe security risk to the machine's state.