improve-convex-plugin

SUSPICIOUS. The skill’s stated purpose matches its behavior—sending session transcripts for Convex tooling improvement with explicit consent—but it relies on a high-risk remote pipe-to-shell installer from a mutable hosted deployment and sends conversation data to remote Convex endpoints. This is more consistent with a legitimate but risky telemetry/helper skill than confirmed malware. The main issue is install/execution trust and intentional transcript exfiltration, not purpose mismatch.