Convex Authz skill for Claude Code: audit and harden authorization

Makes Claude scan your Convex functions for four authorization bugs and fix them with identity and ownership checks.

Installs: 38.6K; on skills.sh
Stars: 68; on GitHub
Updated: Oct 2026; last repo commit

Ask Claude to secure your app, audit auth, or tell you who can access your data. It first checks that the app has a real auth foundation: an auth.config.ts with a provider and a users table keyed to the sign-in subject. If either is missing it does not add checks. It turns privileged public functions into internal ones and tells you to set up auth first.

With the foundation in place it scans every file in convex/ for four shapes: identity taken from an argument, missing ownership checks, public queries that leak data by a client-supplied id, and writes into a parent record the caller does not own. It fixes each hit with requireIdentity and requireOwner helpers, runs npx tsc --noEmit, rescans, and reports each finding with the diff. It skips apps with no convex/ directory.

Good for

Convex developers who want to know who can read or change their data
Developers who want a scan for four specific authorization bug shapes in convex/
Apps that already have sign-in and a users table

Install convex-authz

Claude Code

Copy this prompt.

Install the convex-authz skill in Claude Code. Run this command:

npx skills add https://github.com/convex/agent-skills --skill convex-authz

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Requires Node.js.

Convex's docs say the skills CLI installs skills into .agents/skills/ in your project. The "All Convex skills" command installs every skill in the repo, which has 33 skill folders. One of them, convex-improve-convex-plugin, is listed in the Convex docs as sending your coding session's transcript to the Convex team. Run this skill with /convex-authz in Claude Code or $convex-authz in Codex, or let the agent pick it when the task fits.

From its listing on skills.sh. Source.

What's in the skill

When it loads

Audit and harden a Convex app's authorization: identity-from-arg impersonation, missing per-document ownership checks, public queries leaking data by a client-supplied id, and writes into a parent/container the caller doesn't own. Scans for the 4 shapes, applies requireIdentity/requireOwner, verifies with tsc. TRIGGER on 'secure my app', 'audit auth/authz', 'who can access this data'. SKIP when there is no convex/ directory.

Sections in SKILL.md

Workflow
Rules

Key facts

Author: Convex (the vendor's own repo; Convex's docs list it among the skills it provides)
Repo: convex/agent-skills
License: Apache-2.0 (LICENSE file; the README says original content is Apache-2.0)
Installs on skills.sh: 38,619 (Nov 2, 2026)
GitHub stars: 68 (Nov 2, 2026)
Last commit to the repo: Oct 29, 2026
What installs: 1 file: SKILL.md
Needs: A convex/ directory; the hardening step needs auth.config.ts with a provider and a users table keyed to the sign-in subject
Works in: Claude Code, Cursor, VS Code with GitHub Copilot, Windsurf, Codex (README lists how to invoke skills in each)
skills.sh audits: Gen Agent Trust Hub: pass, Socket: pass, Snyk: pass

What it includes

Needs auth.config.ts with a provider and a subject-keyed users table first
Without them Claude does not add ctx.auth checks. It converts public admin functions to internal ones and tells you to run auth setup, then re-run this skill.
Files · Step 0: check the auth foundation
Greps convex/**/*.ts for identity-from-arg, ownership, PII and parent-write bugs
The four shapes are identity from a userId-style argument, a read or write by id with no ownership check, a public query returning sensitive fields by a client-supplied id, and a write that attaches a row to a parent the caller does not own.
Files · Step 1: scan the four shapes
Adds requireIdentity and requireOwner in convex/model/auth.ts and applies them
requireIdentity throws 401 when there is no identity. requireOwner throws 404 for a missing doc and 403 when the owner does not match. Internal admin functions stay internal.
Write · Step 2: harden
Runs npx tsc --noEmit and rescans until no hits remain
A hardening pass that does not typecheck is not done, per SKILL.md.
Runs code · Step 3: verify
Lists findings by shape with file and line, why each is exploitable, and the diff
It shows the concrete diff applied, not just prose.
Step 4: report

From the official docs

Permissions

Medium risk

Claude edits your Convex function code to add or remove access, so a mistake can lock real users out or leave data open. Run it on a branch, read the diff, and test as signed-in and signed-out users.

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

It can change which functions clients can call
On an app without an auth foundation it turns privileged public functions into internal ones, which removes them from client code. Check your front end after the run. github.com
New checks can lock real users out
Added requireOwner checks throw 403 or 404. If your data model keys owners differently, valid users may be refused. SKILL.md has Claude compare against the users row when ownership uses it, so test that case. github.com
The scan is pattern matching
SKILL.md calls the scan deterministic and regex-based, and tells Claude to still read internal and admin exemptions by eye. A clean scan is not a full security review. github.com

Security advisories

No published security advisories as of Nov 2, 2026.

Technical details

Turning on read-only	No read-only mode. It reports and edits in the same run. Our advice: use a branch.
Scopes	Reads every file under convex/ except convex/_generated Edits function code and adds convex/model/auth.ts Runs npx tsc --noEmit

Questions

How do I install convex-authz?

Use the install box above. The skill is a single SKILL.md. Run it with /convex-authz in Claude Code or $convex-authz in Codex, or say something like "audit my app's auth" and let the agent load it. SKILL.md hands performance, schema and validator findings to convex-reviewer, which you can install separately.

Why did it refuse to add auth checks to my app?

SKILL.md requires an auth.config.ts with a provider and a users table keyed to the sign-in subject first. Without them, ctx.auth.getUserIdentity() always returns null, so checks would not work and would count as a new defect. Run the auth setup, then re-run this skill.

How is it different from convex-reviewer?

convex-authz is a targeted authorization pass that edits your code. Its SKILL.md says to hand performance, schema and validator findings to convex-reviewer. convex-reviewer's SKILL.md describes a broader review that reports findings with severity.

Will it break my front end?

It can. Turning a public function into an internal one removes it from clients, and new checks throw 401, 403 or 404 for callers who no longer qualify. Run your app and tests after it finishes.

Is it safe?

It rewrites function code in convex/, which can change who is allowed to call what. SKILL.md has Claude verify with npx tsc --noEmit, but a typecheck does not test behavior. Our advice: run it on a branch, read the diff, and test your app as a signed-in and a signed-out user.

Is it official?

Yes. It is in Convex's own agent-skills repo, and Convex's docs list it among the agent skills Convex provides.

Does it work in the Claude app?

The README and Convex docs name Claude Code, Cursor, VS Code with GitHub Copilot, Windsurf and Codex. They do not name the Claude app, and this skill works on a local project, so we list no Claude app install.

Information

updated Nov 2, 2026

Repository: convex/agent-skills
Folder: skills/convex-authz

convex/agent-skills skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 4

convex/agent-skills README · github.com
Convex docs: Agent Skills · docs.convex.dev
convex-authz SKILL.md · github.com
convex-reviewer SKILL.md · github.com