# Convex Reviewer

Convex code reviewer, security, auth, validators, performance, and pattern checks for...

- Repository: https://github.com/openclaw/clawhub (9543 stars)
- Category: Security
- License: MIT
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add openclaw/clawhub --skill convex-reviewer -g -a claude-code -y`
Codex: `npx skills add openclaw/clawhub --skill convex-reviewer -g -a codex -y`
Cursor: `npx skills add openclaw/clawhub --skill convex-reviewer -g -a cursor -y`
Gemini CLI: `npx skills add openclaw/clawhub --skill convex-reviewer -g -a gemini-cli -y`

## Description

Convex code reviewer, security, auth, validators, performance, and pattern checks for code in a convex/ directory. Use to review or audit Convex functions before shipping.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

<!-- GENERATED from convex-agents content/capabilities/convex-reviewer.json, do not edit by hand. -->

# Convex Code Reviewer

Structured review of Convex code for security, authorization, validators, performance, and schema design. Applies a Convex-specific checklist and flags anti-patterns with severity (Critical / Important / Suggestion).

## Workflow

1. First pass, Security: verify all public functions check ctx.auth.getUserIdentity(), verify resource ownership before reads/writes, confirm no client-provided user IDs are trusted, confirm scheduled functions target internal.* not api.*.
2. Second pass, Performance: confirm no .filter() on DB queries (withIndex required), verify all foreign-key fields have indexes, confirm no Date.now() in query handlers, confirm .collect() is not used on unbounded queries.
3. Third pass, Code quality: confirm args and returns validators on every public function, no any types, promises are awaited, arrays in documents are bounded (<8192 elements).
4. Report findings grouped by severity; explain why each issue matters and suggest a fix.

## Rules

- Flag missing auth checks as Critical, any unauthenticated public mutation is a data-loss risk.
- Flag .filter() on DB queries as Important, it is a full table scan.
- Flag Date.now() in query handlers as Important, it breaks reactivity.
- Flag missing args or returns validators as Important.
- Flag scheduling to api.* (not internal.*) as Important.
- Always explain why a change is needed, not just what to change.