improve-convex-plugin

SUSPICIOUS. The skill’s purpose and data flow are internally consistent: it is meant to export transcripts for system improvement, and it asks for opt-in consent. However, it relies on a remote unpinned curl|bash helper and sends sensitive local session data to a backend that is not documented through a verifiable official release path. This is a high supply-chain and privacy risk, though not confirmed malware.