AutoGineer
Generated banner for Convex Reviewer
Generated logo for Convex Reviewer

Convex Reviewer

ConvexOfficialPublished by Convex

  • Skill
  • Review and audit
  • Software development
  • Apache-2.0
  • No issues found
Download ZIP

From the author

Convex code reviewer — security, auth, validators, performance, and pattern checks for code in a convex/ directory. Use to review or audit Convex functions before shipping.
— the description by Convex

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

The Convex Code Reviewer provides a structured, multi-pass audit process for code located in a convex/ directory. It systematically evaluates functions against a set of Convex-specific rules, focusing on security vulnerabilities, performance bottlenecks, and code quality. By categorizing findings by severity—Critical, Important, or Suggestion—it helps developers identify and remediate issues before deployment.

What it does

  • Performs a security audit to ensure proper authentication and resource ownership checks.
  • Identifies performance anti-patterns like unbounded queries or missing indexes.
  • Validates code quality by checking for missing argument and return validators.
  • Ensures scheduled functions correctly target internal rather than public API paths.
  • Provides detailed explanations for each finding to help developers understand the underlying risk.
  • Categorizes issues by severity to prioritize critical security and data risks.

When to use it

  • Use before shipping new Convex functions to production.
  • Use during code reviews to ensure adherence to Convex best practices.
  • Use when auditing existing codebases for potential security or performance regressions.
  • Use to verify that database queries are optimized and properly indexed.

Advantages

  • Reduces the risk of unauthenticated data access or modification.
  • Improves application performance by flagging inefficient database operations.
  • Ensures consistent use of validators and type safety across the project.
  • Provides actionable feedback with clear explanations for every flagged issue.

Usage examples

“Review my convex/functions.ts file for security and performance issues.”
The agent performs a three-pass audit, flagging any missing auth checks, inefficient .filter() calls, or missing validators, and provides a report with suggested fixes.

Install

  1. Download the skill as a ZIP:

    https://mp-staging.autogineer.com/agent-skills/convex/convex-reviewer/download

  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip convex-reviewer.zip -d .agents/skills

Documentation by Convex

<!-- GENERATED from convex-agents content/capabilities/convex-reviewer.json — do not edit by hand. -->

Convex Code Reviewer

Structured review of Convex code for security, authorization, validators, performance, and schema design. Applies a Convex-specific checklist and flags anti-patterns with severity (Critical / Important / Suggestion).

Workflow

  1. First pass — Security: verify all public functions check ctx.auth.getUserIdentity(), verify resource ownership before reads/writes, confirm no client-provided user IDs are trusted, confirm scheduled functions target internal.* not api.*.

  2. Second pass — Performance: confirm no .filter() on DB queries (withIndex required), verify all foreign-key fields have indexes, confirm no Date.now() in query handlers, confirm .collect() is not used on unbounded queries.

  3. Third pass — Code quality: confirm args and returns validators on every public function, no any types, promises are awaited, arrays in documents are bounded (<8192 elements).

  4. Report findings grouped by severity; explain why each issue matters and suggest a fix.

Rules

  • Flag missing auth checks as Critical — any unauthenticated public mutation is a data-loss risk.

  • Flag .filter() on DB queries as Important — it is a full table scan.

  • Flag Date.now() in query handlers as Important — it breaks reactivity.

  • Flag missing args or returns validators as Important.

  • Flag scheduling to api.* (not internal.*) as Important.

  • Always explain why a change is needed, not just what to change.

Files

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Published by
Convex
Publisher
Convex (Official)
Source
convex/agent-skills · skills/convex-reviewer · commit f60629d
Licence
Apache License 2.0 (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by Convex.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download convex-reviewer.zip