Convex Verify

Most AI-written Convex code passes typecheck and fails on authorization, so this skill goes straight at that gap. You point it at a specific query, mutation, or action you just built, and it seeds realistic data (the caller's rows plus a second user's rows), then drives the function as the owner, as a different authenticated user, and unauthenticated, all in-process with convex-test. The part worth using is the negative assertions: it checks that the wrong caller is refused and that list queries return only the caller's rows. It also sets up the vitest config convex-test needs (edge-runtime environment with convex-test inlined), which otherwise fails with a confusing import.meta.glob error. The honest caveat is that it only proves what you tell it the intended contract is, so if the feature's rules are fuzzy, expect a clarifying question first.

skills.sh installs: 41K
GitHub stars: 69
last updated: Oct 26, 2026

View on GitHub

Install

$ npx -y skills add convex/agent-skills --skill convex-verify --agent claude-code

Installs into .claude/skills of the current project.

Files

Prove a feature works — seed, drive, assert

A green typecheck proves the code parses; it does not prove a non-owner is actually denied, that a query returns the right rows, or that a mutation has the effect it claims. This capability closes that gap with the loop the whole field is missing: seed → drive → assert, run in-process with convex-test so it needs no deployment. Its highest-value assertions are the NEGATIVE ones — the caller who should be refused — because those are exactly the authz defects the 30-app corpus shows are the #1 real bug and the ones a happy-path demo never catches.