convex-add

SUSPICIOUS: the skill's stated purpose is coherent, but its main control path depends on mutable remote markdown from a .convex.site endpoint that the agent is instructed to follow. That creates a high indirect prompt-injection and execution-trust risk even without visible credential theft or explicit malware behavior.