使用方法
- 复制安装命令，在自己的智能体环境安装前先检查源码包。
- 从原始文档核对所需工具、凭据和支持的宿主。
- 说明输入材料与期望交付物，并对照来源检查输出。
npx skills add https://github.com/convex/agent-skills --skill convex-reviewer开始前需了解
- 安装不包含模型订阅、API 额度或访问文件的权限。
- 仓库星数和安装量反映活跃情况，不等于独立质量或安全测试。
仓库原始内容
按源仓库内容呈现，保留标题、案例、代码、表格、链接以及原文引用的演示图片。
<!-- GENERATED from convex-agents content/capabilities/convex-reviewer.json — do not edit by hand. -->
Convex Code Reviewer
Structured review of Convex code for security, authorization, validators, performance, and schema design. Applies a Convex-specific checklist and flags anti-patterns with severity (Critical / Important / Suggestion).
Workflow
- First pass — Security: verify all public functions check ctx.auth.getUserIdentity(), verify resource ownership before reads/writes, confirm no client-provided user IDs are trusted, confirm scheduled functions target internal. not api..
- Second pass — Performance: confirm no .filter() on DB queries (withIndex required), verify all foreign-key fields have indexes, confirm no Date.now() in query handlers, confirm .collect() is not used on unbounded queries.
- Third pass — Code quality: confirm args and returns validators on every public function, no any types, promises are awaited, arrays in documents are bounded (<8192 elements).
- Report findings grouped by severity; explain why each issue matters and suggest a fix.
Rules
- Flag missing auth checks as Critical — any unauthenticated public mutation is a data-loss risk.
- Flag .filter() on DB queries as Important — it is a full table scan.
- Flag Date.now() in query handlers as Important — it breaks reactivity.
- Flag missing args or returns validators as Important.
- Flag scheduling to api. (not internal.) as Important.
- Always explain why a change is needed, not just what to change.
