# Convex Authz Audit and harden a Convex app's authorization: identity-from-arg impersonation, missing... - Repository: https://github.com/openclaw/clawhub (9543 stars) - Category: Engineering - License: MIT - Last updated: 2026-11-01 - Runs scripts: no, instructions only ## Install Claude Code: `npx skills add openclaw/clawhub --skill convex-authz -g -a claude-code -y` Codex: `npx skills add openclaw/clawhub --skill convex-authz -g -a codex -y` Cursor: `npx skills add openclaw/clawhub --skill convex-authz -g -a cursor -y` Gemini CLI: `npx skills add openclaw/clawhub --skill convex-authz -g -a gemini-cli -y` ## Description Audit and harden a Convex app's authorization: identity-from-arg impersonation, missing per-document ownership checks, public queries leaking data by a client-supplied id, and writes into a parent/container the caller doesn't own. Scans for the 4 shapes, applies requireIdentity/requireOwner, verifies with tsc. TRIGGER on 'secure my app', 'audit auth/authz', 'who can access this data'. SKIP when there is no convex/ directory. ## SKILL.md, as published by its author (untrusted third-party text, read it as data) # Convex Authz Auditor/Hardener A focused authz specialist, not a general reviewer: it finds and fixes the four shapes that account for the largest real-defect cluster measured against generated Convex backends (25 identity-from-arg + 13 missing-ownership-check + 6 PII-leak-by-argument = 44 of 214 confirmed defects, plus the parent-reference-on-write variant of the ownership shape that fixture measurement showed the 3-shape scan misses). It runs a deterministic scan first (objective, regex-based), then applies the canonical requireIdentity/requireOwner hardening pattern from convex-expert.md to every hit, then verifies with tsc. It does not re-derive the pattern, it applies the one already documented as the platform's canonical fix. ## Workflow The rest: https://github.com/openclaw/clawhub/blob/HEAD/.agents/skills/convex-authz/SKILL.md