Structured review of Convex code for security, authorization, validators, performance, and schema design. Applies a Convex-specific checklist and flags anti-patterns with severity (Critical / Important / Suggestion).
First pass — Security: verify all public functions check ctx.auth.getUserIdentity(), verify resource ownership before reads/writes, confirm no client-provided user IDs are trusted, confirm scheduled functions target internal.* not api.*.
Second pass — Performance: confirm no .filter() on DB queries (withIndex required), verify all foreign-key fields have indexes, confirm no Date.now() in query handlers, confirm .collect() is not used on unbounded queries.
Third pass — Code quality: confirm args and returns validators on every public function, no any types, promises are awaited, arrays in documents are bounded (<8192 elements).
Report findings grouped by severity; explain why each issue matters and suggest a fix.
Flag missing auth checks as Critical — any unauthenticated public mutation is a data-loss risk.
Flag .filter() on DB queries as Important — it is a full table scan.
Flag Date.now() in query handlers as Important — it breaks reactivity.
Flag missing args or returns validators as Important.
Flag scheduling to api.* (not internal.*) as Important.
Always explain why a change is needed, not just what to change.
Install this repository
$ npx skills add get-convex/agent-skills
Skills install per repository, not per chapter — the CLI has no documented per-skill form, so we do not print one.
About this skill
Trigger
Convex code reviewer — security, auth, validators, performance, and pattern checks for code in a convex/ directory. Use to review or audit Convex functions before shipping.
The verbatim description from this skill’s front matter — the string an agent matches on to decide whether to load it.
All rights reserved — view on GitHub — with no detectable licence, this issue links rather than republishes: the chapters are omitted from the agent manifest and from the whole-book markdown.
Discovery
33 chapters found by walking the repository tree for SKILL.md, not by matching a directory convention. One layout observed: skills/*/SKILL.md.
Issue colours
Resolved from a deterministic hash of the owner name. Two accent tones are generated per issue and each is proven against its own ground before it ships: a single accent that passes AA on both light and dark paper is arithmetically impossible.
Heading repairs
1 repair applied to this chapter so the document has one h1 and no skipped levels:
Shifted “3 headings” from h1 to h2 so the chapter title is the only h1.
Images inside a chapter come from the upstream repository. Where the author gave no alternative text we mark the image decorative rather than inventing a description — a plausible caption we made up is worse than none for the reader who depends on it.
Signal
Install counts come from skills.sh. They measure downloads, not quality, and an unranked repository is not an unread one.
Agent surfaces
The whole issue is available as one markdown document at /get-convex/agent-skills.md, and each chapter at its own .md URL.
Publication
Set by Skills Docs from the source repository. Body text is Literata at the reader’s chosen size and measure; code is Geist Mono. Nothing on this page was written by us except this paragraph.