skills/get-convex/agent-skills/convex-check-updates/Socket

convex-check-updates

Warn

Audited by Socket on Aug 1, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS. The skill's purpose is plausible, and its user-consent/build-gate workflow is scoped to upgrades, but it relies on downloading and executing an unpinned remote script from an app-hosted .convex.site endpoint rather than a verifiable package or release channel. That install/exec trust problem dominates the assessment.

Confidence: 86%Severity: 84%

Audit Metadata

Analyzed At

Aug 1, 2026, 05:27 PM

Package URL

pkg:socket/skills-sh/get-convex%2Fagent-skills%2Fconvex-check-updates%2F@e6b9f709d9acb8b5dae90c67cfbf7074a3e3fd188e91201392cae088c212c3d8