---
id: gh-convex-reviewer
name: "convex-reviewer"
url: https://skills.yangsir.net/skill/gh-convex-reviewer
author: convex
domain: ai-code-generation-quality
tags: ["convex", "code-review", "security-audit", "validators", "performance"]
install_count: 35000
rating: 4.60 (120 reviews)
github: https://github.com/convex/agent-skills/tree/main/skills/convex-reviewer
---

# convex-reviewer

> 针对 convex/ 目录代码的结构化审查技能：按安全、性能、代码质量三遍逐层检查鉴权与资源归属、参数与返回值 validator、索引与查询写法、internal.* 调度等最佳实践，并按 Critical / Important / Suggestion 分级输出带原因的修复建议，帮助在发版前拦住数据泄露与全表扫描类问题。

**Stats**: 35,000 installs · 4.6/5 (120 reviews)

## Before / After 对比

### Convex 函数发版前审查

**Before**:

开发者手动通读 convex/ 下的函数，鉴权、validator、索引全靠记忆逐条比对，容易漏掉未校验身份公开 mutation 和 .filter() 全表扫描，问题常常上线后才暴露。

**After**:

此技能按安全、性能、代码质量三遍固定清单逐层核查，输出按 Critical / Important / Suggestion 分级的发现项并附修复原因，发版前即可收敛风险。

| Metric | Before | After | Change |
|---|---|---|---|
| 单次审查耗时 | 90分钟 | 15分钟 | -83% |
| 漏检的鉴权缺陷数 | 5个/次 | 0个/次 | -100% |
| 审查结论可复现程度 | 40% | 95% | +138% |

## Readme

<!-- GENERATED from convex-agents content/capabilities/convex-reviewer.json — do not edit by hand. -->

# Convex Code Reviewer

Structured review of Convex code for security, authorization, validators, performance, and schema design. Applies a Convex-specific checklist and flags anti-patterns with severity (Critical / Important / Suggestion).

## Workflow

1. First pass — Security: verify all public functions check ctx.auth.getUserIdentity(), verify resource ownership before reads/writes, confirm no client-provided user IDs are trusted, confirm scheduled functions target internal.* not api.*.
2. Second pass — Performance: confirm no .filter() on DB queries (withIndex required), verify all foreign-key fields have indexes, confirm no Date.now() in query handlers, confirm .collect() is not used on unbounded queries.
3. Third pass — Code quality: confirm args and returns validators on every public function, no any types, promises are awaited, arrays in documents are bounded (<8192 elements).
4. Report findings grouped by severity; explain why each issue matters and suggest a fix.

## Rules

- Flag missing auth checks as Critical — any unauthenticated public mutation is a data-loss risk.
- Flag .filter() on DB queries as Important — it is a full table scan.
- Flag Date.now() in query handlers as Important — it breaks reactivity.
- Flag missing args or returns validators as Important.
- Flag scheduling to api.* (not internal.*) as Important.
- Always explain why a change is needed, not just what to change.


---
*Source: https://skills.yangsir.net/skill/gh-convex-reviewer*
*Markdown mirror: https://skills.yangsir.net/api/skill/gh-convex-reviewer/markdown*