Description
convex-reviewer is an agent skill for reviewing Convex code in a convex/ directory. It checks security, authorization, validators, performance and schema design, and it applies a Convex-specific checklist to flag anti-patterns, labelled Critical, Important or Suggestion. The review has passes. The security pass checks that public functions call ctx.auth.getUserIdentity(), that ownership is verified before reads and writes, that client-supplied user IDs are not trusted, and that scheduled functions target internal functions rather than public ones. The performance pass looks for filters applied to database queries instead of indexed queries, for foreign-key fields that lack an index, and for other costly patterns. The skill is for reviewing or auditing a Convex codebase, and it reports findings grouped by severity so a team can decide what to fix first. It is part of the get-convex agent-skills repository and is added to a compatible agent with the skills command. Its audits passed with Gen Agent Trust Hub, Socket and Snyk. It suits teams that want a second pair of eyes on Convex functions before they ship, especially for authorization.…
Highlights
- Security and authorization checks
- Validator, performance and schema review
- Findings labelled Critical, Important or Suggestion
- Checks for indexed queries and scheduled internal calls
Ratings & Reviews
No ratings yet
Be the first to rate convex-reviewer.
People also visit
convex-reviewer FAQ
What does convex-reviewer do?
It reviews Convex code for security, authorization, validators, performance and schema design.
How are findings ranked?
As Critical, Important or Suggestion.
What does the security pass check?
That public functions check the user identity, that ownership is verified, that client IDs are not trusted, and that scheduled functions call internal functions.
What does the performance pass check?
Filters on database queries instead of indexes, and foreign-key fields without an index.
How do I install it?
Run: npx skills add https://github.com/get-convex/agent-skills --skill convex-reviewer
What security audits has it passed?
Gen Agent Trust Hub, Socket and Snyk all passed.
What are the best convex-reviewer alternatives?
Popular alternatives to convex-reviewer include code-reviewer, security-review and ponytail-review. See all convex-reviewer alternatives