convex-add

SUSPICIOUS. The skill is broadly aligned with its Convex app-extension purpose and references at least one official same-org package, but it gives a mutable remotely hosted catalog and markdown docs decision-making authority and relies on unreviewable fallback scripts and live component selection. This is better characterized as medium supply-chain/trust risk than confirmed malware.