Convex Authz

Convex apps tend to ship with the same few authorization holes: a userId passed as a client argument that anyone can forge, a db.patch on a document id with no ownership check, a public query that returns email or revenue for whatever id it's handed, and a mutation that drops a child row into a project the caller doesn't belong to. This skill scans convex/ for those four shapes with regexes first, then applies the requireIdentity and requireOwner pattern from the convex-expert reference and reruns tsc to confirm. I like that it refuses to add ctx.auth checks to a repo that has no auth.config.ts or subject-keyed users table, since enforcement there silently does nothing and only makes the code look safer. The catch is the scanner is regex-based, so expect it to miss creative patterns, and read the diff before trusting it.

skills.sh installs: 41.3K
GitHub stars: 69
last updated: Oct 26, 2026

View on GitHub

Install

$ npx -y skills add convex/agent-skills --skill convex-authz --agent claude-code

Installs into .claude/skills of the current project.

Files

Convex Authz Auditor/Hardener

A focused authz specialist, not a general reviewer: it finds and fixes the four shapes that account for the largest real-defect cluster measured against generated Convex backends (25 identity-from-arg + 13 missing-ownership-check + 6 PII-leak-by-argument = 44 of 214 confirmed defects, plus the parent-reference-on-write variant of the ownership shape that fixture measurement showed the 3-shape scan misses). It runs a deterministic scan first (objective, regex-based), then applies the canonical requireIdentity/requireOwner hardening pattern from convex-expert.md to every hit, then verifies with tsc. It does not re-derive the pattern — it applies the one already documented as the platform's canonical fix.