skills/get-convex/agent-skills/convex-add/Socket

convex-add

Warn

Audited by Socket on Aug 1, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS: the stated purpose is coherent for a Convex add-capability skill, and the fallback use of npm/@convex-dev components is proportionate. However, the skill’s primary control path depends on remotely served markdown instructions from a mutable catalog, which creates a meaningful indirect prompt-injection and remote-behavior trust risk even though the endpoint appears to be Convex-hosted.

Confidence: 84%Severity: 64%

Audit Metadata

Analyzed At

Aug 1, 2026, 05:26 PM

Package URL

pkg:socket/skills-sh/get-convex%2Fagent-skills%2Fconvex-add%2F@43c478d3da6dfcf3419739130eae8465eab7a629d84818476eb355606de88950