Convex Reviewer

If you're shipping Convex functions and want a second pair of eyes before they go live, convex-reviewer walks through a `convex/` directory in three passes: security and auth first (every public function should check `ctx.auth.getUserIdentity()` and verify ownership), then performance (flagging `.filter()` on queries, missing indexes on foreign keys, and unbounded `.collect()`), then code quality like missing `args` and `returns` validators or unawaited promises. Findings come back grouped as Critical, Important, or Suggestion, with the reasoning attached rather than just the fix. The checklist is opinionated and Convex-specific, so it won't catch general JavaScript problems, but for catching the mistakes that actually bite Convex apps in production, it's a sensible pre-ship pass.

skills.sh installs: 41.3K
GitHub stars: 69
last updated: Oct 26, 2026

View on GitHub

Install

$ npx -y skills add convex/agent-skills --skill convex-reviewer --agent claude-code

Installs into .claude/skills of the current project.

Files

Convex Code Reviewer

Structured review of Convex code for security, authorization, validators, performance, and schema design. Applies a Convex-specific checklist and flags anti-patterns with severity (Critical / Important / Suggestion).

Workflow

First pass — Security: verify all public functions check ctx.auth.getUserIdentity(), verify resource ownership before reads/writes, confirm no client-provided user IDs are trusted, confirm scheduled functions target internal.* not api.*.
Second pass — Performance: confirm no .filter() on DB queries (withIndex required), verify all foreign-key fields have indexes, confirm no Date.now() in query handlers, confirm .collect() is not used on unbounded queries.
Third pass — Code quality: confirm args and returns validators on every public function, no any types, promises are awaited, arrays in documents are bounded (<8192 elements).
Report findings grouped by severity; explain why each issue matters and suggest a fix.