quickstart

SUSPICIOUS: the skill’s purpose mostly matches scaffolding a local Convex app, but its core functionality depends on downloading and executing a remote shell script from an opaque convex.site subdomain and then following a remote runbook as canonical. That creates a significant supply-chain and remote-instruction trust risk, even without clear credential theft or confirmed malicious behavior.