convex-reviewer

get-convex/agent-skills/convex-reviewer

Convex 代码审查器提供对 Convex 代码的结构化审查，涵盖安全、授权、验证器、性能和模式设计。它应用 Convex 特定的检查清单，并按严重性（严重 / 重要 / 建议）标记反模式。工作流程包括三轮检查：第一轮检查安全，确保所有公共函数检查 ctx.auth.getUserIdentity()，验证资源所有权，不信任客户端提供的用户 ID，并确认计划任务针对 internal.* 而非 api.*。第二轮检查性能，确保数据库查询不使用 .filter()（应使用 withIndex），外键字段有索引，查询处理器中不使用 Date.now()，且不对无界查询使用 .collect()。第三轮检查代码质量，确保每个公共函数都有参数和返回验证器，没有 any 类型，promise 被等待，文档中的数组有界（<8192 个元素）。最后，按严重性分组报告发现，并解释每个问题的重要性及建议修复方法。

安装量 · 494查看来源

Installation

npx skills add https://github.com/get-convex/agent-skills --skill convex-reviewer

技能文件

SKILL.md

最近同步 · 2026年8月29日

SKILL.md›

---
name: convex-reviewer
description: "Convex code reviewer — security, auth, validators, performance, and pattern checks for code in a convex/ directory. Use to review or audit Convex functions before shipping."
---

<!-- GENERATED from convex-agents content/capabilities/convex-reviewer.json — do not edit by hand. -->

# Convex Code Reviewer

Structured review of Convex code for security, authorization, validators, performance, and schema design. Applies a Convex-specific checklist and flags anti-patterns with severity (Critical / Important / Suggestion).

## Workflow

1. First pass — Security: verify all public functions check ctx.auth.getUserIdentity(), verify resource ownership before reads/writes, confirm no client-provided user IDs are trusted, confirm scheduled functions target internal.* not api.*.
2. Second pass — Performance: confirm no .filter() on DB queries (withIndex required), verify all foreign-key fields have indexes, confirm no Date.now() in query handlers, confirm .collect() is not used on unbounded queries.
3. Third pass — Code quality: confirm args and returns validators on every public function, no any types, promises are awaited, arrays in documents are bounded (<8192 elements).
4. Report findings grouped by severity; explain why each issue matters and suggest a fix.

## Rules

- Flag missing auth checks as Critical — any unauthenticated public mutation is a data-loss risk.
- Flag .filter() on DB queries as Important — it is a full table scan.
- Flag Date.now() in query handlers as Important — it breaks reactivity.
- Flag missing args or returns validators as Important.
- Flag scheduling to api.* (not internal.*) as Important.
- Always explain why a change is needed, not just what to change.