add

SUSPICIOUS: the stated purpose fits app scaffolding, but the actual footprint relies on authoritative remote instructions plus unpinned curl|bash installers from an opaque convex.site subdomain that I could not verify as Convex’s official documented distribution channel. The combination of remote prompt steering and direct remote code execution is disproportionate to a benign add-capability helper.