quickstart
Warn
Audited by Socket on Oct 24, 2026
1 alert found:
SecuritySecuritySKILL.md
MEDIUMSecurityMEDIUM
SKILL.md
SUSPICIOUS. The skill's purpose mostly matches its developer-scaffolding behavior, and the network endpoints appear tied to Convex infrastructure, but its main path depends on executing an undocumented, unpinned remote bootstrap script from a hosted endpoint. Data egress is limited and disclosed, yet install/execution trust is weaker than expected for a local quickstart.
Confidence: 82%Severity: 72%
Audit Metadata