AutoGineer
Generated banner for Convex Reviewer
Generated logo for Convex Reviewer

Convex Reviewer

ConvexOfficialPublished by Convex

  • Skill
  • Review and audit
  • Software development
  • Apache-2.0
  • No issues found
Download ZIP

From the author

Convex code reviewer — security, auth, validators, performance, and pattern checks for code in a convex/ directory. Use to review or audit Convex functions before shipping.
— the description by Convex

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

The Convex Code Reviewer provides a structured, multi-pass audit process for code located in a convex/ directory. It systematically evaluates functions against a set of Convex-specific rules, focusing on security vulnerabilities, performance bottlenecks, and code quality. By categorizing findings by severity—Critical, Important, or Suggestion—it helps developers identify and remediate issues before deployment.

What it does

  • Performs a security audit to ensure proper authentication and resource ownership checks.
  • Identifies performance anti-patterns like unbounded queries or missing indexes.
  • Validates code quality by checking for missing argument and return validators.
  • Ensures scheduled functions correctly target internal rather than public API paths.
  • Provides detailed explanations for each finding to help developers understand the underlying risk.
  • Categorizes issues by severity to prioritize critical security and data risks.

When to use it

  • Use before shipping new Convex functions to production.
  • Use during code reviews to ensure adherence to Convex best practices.
  • Use when auditing existing codebases for potential security or performance regressions.
  • Use to verify that database queries are optimized and properly indexed.

Advantages

  • Reduces the risk of unauthenticated data access or modification.
  • Improves application performance by flagging inefficient database operations.
  • Ensures consistent use of validators and type safety across the project.
  • Provides actionable feedback with clear explanations for every flagged issue.

Usage examples

“Review my convex/functions.ts file for security and performance issues.”
The agent performs a three-pass audit, flagging any missing auth checks, inefficient .filter() calls, or missing validators, and provides a report with suggested fixes.

Install

  1. Download the skill as a ZIP:

    https://autogineer.com/agent-skills/convex/convex-reviewer/download

  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip convex-reviewer.zip -d .agents/skills

Documentation by Convex

<!-- GENERATED from convex-agents content/capabilities/convex-reviewer.json — do not edit by hand. -->

Convex Code Reviewer

Structured review of Convex code for security, authorization, validators, performance, and schema design. Applies a Convex-specific checklist and flags anti-patterns with severity (Critical / Important / Suggestion).

Workflow

  1. First pass — Security: verify all public functions check ctx.auth.getUserIdentity(), verify resource ownership before reads/writes, confirm no client-provided user IDs are trusted, confirm scheduled functions target internal.* not api.*.

  2. Second pass — Performance: confirm no .filter() on DB queries (withIndex required), verify all foreign-key fields have indexes, confirm no Date.now() in query handlers, confirm .collect() is not used on unbounded queries.

  3. Third pass — Code quality: confirm args and returns validators on every public function, no any types, promises are awaited, arrays in documents are bounded (<8192 elements).

  4. Report findings grouped by severity; explain why each issue matters and suggest a fix.

Rules

  • Flag missing auth checks as Critical — any unauthenticated public mutation is a data-loss risk.

  • Flag .filter() on DB queries as Important — it is a full table scan.

  • Flag Date.now() in query handlers as Important — it breaks reactivity.

  • Flag missing args or returns validators as Important.

  • Flag scheduling to api.* (not internal.*) as Important.

  • Always explain why a change is needed, not just what to change.

Files

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Published by
Convex
Publisher
Convex (Official)
Source
convex/agent-skills · skills/convex-reviewer · commit f60629d
Licence
Apache License 2.0 (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by Convex or Convex.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download convex-reviewer.zip