labs-quickstart
Warn
Audited by Socket on Oct 24, 2026
1 alert found:
SecuritySecuritySKILL.md
MEDIUMSecurityMEDIUM
SKILL.md
SUSPICIOUS. The skill's purpose mostly matches a quickstart scaffold, but its core workflow depends on downloading and running an unsigned remote shell script from a shared Convex-hosted app endpoint, with no clear official release verification. Data flows are mostly proportionate, but the remote bootstrap trust model is too broad for a local scaffolding skill.
Confidence: 89%Severity: 76%
Audit Metadata