labs-quickstart

Warn

Audited by Socket on Oct 24, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

SUSPICIOUS. The skill's purpose mostly matches a quickstart scaffold, but its core workflow depends on downloading and running an unsigned remote shell script from a shared Convex-hosted app endpoint, with no clear official release verification. Data flows are mostly proportionate, but the remote bootstrap trust model is too broad for a local scaffolding skill.

Confidence: 89%Severity: 76%
Audit Metadata
Analyzed At
Oct 24, 2026, 08:00 AM
Package URL
pkg:socket/skills-sh/convex%2Fconvex-backend-skill%2Flabs-quickstart%2F@e5521bcdda8f24ac0f08c580de122d90b09cab6f498b1d288573260b24d63aa4