convex-reviewer
A structured review skill for code inside a convex/ directory: it runs three passes (security, performance, code quality) to verify auth and resource-ownership checks, args/returns validators, index usage, and internal.* scheduling, then reports findings grouped by Critical / Important / Suggestion with the reasoning behind each fix. Use it to audit Convex functions before shipping and catch data-loss or full-table-scan issues early.
npx skills add https://github.com/convex/agent-skills --skill convex-reviewerBefore / After Comparison
1 组Developers read every function under convex/ by hand, checking auth, validators, and indexes from memory. Unauthorized public mutations and .filter() full-table scans slip through and surface only after release.
This skill walks a fixed three-pass checklist (security, performance, code quality) and reports findings graded Critical / Important / Suggestion with the reason behind each fix, so risks are closed before shipping.
Convex Code Reviewer
Structured review of Convex code for security, authorization, validators, performance, and schema design. Applies a Convex-specific checklist and flags anti-patterns with severity (Critical / Important / Suggestion).
Workflow
- First pass — Security: verify all public functions check ctx.auth.getUserIdentity(), verify resource ownership before reads/writes, confirm no client-provided user IDs are trusted, confirm scheduled functions target internal.* not api.*.
- Second pass — Performance: confirm no .filter() on DB queries (withIndex required), verify all foreign-key fields have indexes, confirm no Date.now() in query handlers, confirm .collect() is not used on unbounded queries.
- Third pass — Code quality: confirm args and returns validators on every public function, no any types, promises are awaited, arrays in documents are bounded (<8192 elements).
- Report findings grouped by severity; explain why each issue matters and suggest a fix.
Rules
- Flag missing auth checks as Critical — any unauthenticated public mutation is a data-loss risk.
- Flag .filter() on DB queries as Important — it is a full table scan.
- Flag Date.now() in query handlers as Important — it breaks reactivity.
- Flag missing args or returns validators as Important.
- Flag scheduling to api.* (not internal.*) as Important.
- Always explain why a change is needed, not just what to change.
User Reviews (0)
Write a Review
No reviews yet
Statistics
User Rating
Rate this Skill