Convex Reviewer skill for Claude Code: review your Convex backend before you ship

Makes Claude review code in your convex/ folder in three passes and report problems by severity: Critical, Important or Suggestion.

Installs: 38.5K; on skills.sh
Stars: 68; on GitHub
Updated: Oct 2026; last repo commit

Ask Claude to review or audit your Convex functions. It makes three passes. Security checks that public functions use ctx.auth.getUserIdentity(), verify ownership, never trust client-sent user IDs, and schedule internal.* rather than api.*. Performance flags .filter() on database queries, missing indexes on foreign-key fields, Date.now() in query handlers and .collect() on unbounded queries. Code quality checks validators, any types, awaited promises and arrays kept under 8192 elements.

The result is a report grouped by severity, with a reason and a suggested fix for each finding. A missing auth check is Critical. The skill folder holds one file, SKILL.md.

Good for

Convex developers who want a checklist review before shipping
Developers who want a review of the code in a convex/ directory
Claude Code, Cursor and Codex users who already run skills

Install convex-reviewer

Claude Code

Copy this prompt.

Install the convex-reviewer skill in Claude Code. Run this command:

npx skills add https://github.com/convex/agent-skills --skill convex-reviewer

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Requires Node.js.

Convex's docs say the skills CLI installs skills into .agents/skills/ in your project. The "All Convex skills" command installs every skill in the repo, which has 33 skill folders. One of them, convex-improve-convex-plugin, is listed in the Convex docs as sending your coding session's transcript to the Convex team. Run this skill with /convex-reviewer in Claude Code or $convex-reviewer in Codex, or let the agent pick it when the task fits.

From its listing on skills.sh. Source.

What's in the skill

When it loads

Convex code reviewer — security, auth, validators, performance, and pattern checks for code in a convex/ directory. Use to review or audit Convex functions before shipping.

Sections in SKILL.md

Workflow
Rules

Key facts

Author: Convex (the vendor's own repo; Convex's docs list it among the skills it provides)
Repo: convex/agent-skills
License: Apache-2.0 (LICENSE file; the README says original content is Apache-2.0)
Installs on skills.sh: 38,527 (Nov 2, 2026)
GitHub stars: 68 (Nov 2, 2026)
Last commit to the repo: Oct 29, 2026
What installs: 1 file: SKILL.md
Needs: A convex/ directory to review
Works in: Claude Code, Cursor, VS Code with GitHub Copilot, Windsurf, Codex (README lists how to invoke skills in each)
skills.sh audits: Gen Agent Trust Hub: pass, Socket: pass, Snyk: pass

What it includes

Checks auth on public functions, ownership, client-sent user IDs and scheduling targets
Every public function should check ctx.auth.getUserIdentity(). Scheduled functions should target internal.* functions, not api.*.
Files · First pass: security
Flags .filter() on queries, unindexed foreign keys, Date.now() and unbounded .collect()
.filter() on a database query is a full table scan. Date.now() in a query handler breaks reactivity.
Files · Second pass: performance
Checks args and returns validators, any types, awaited promises, bounded arrays
Arrays stored in documents should stay under 8192 elements.
Files · Third pass: code quality
Groups findings as Critical, Important or Suggestion, with why and a fix
SKILL.md rates a missing auth check as Critical. It rates .filter() on queries, Date.now() in queries, missing validators and api.* scheduling as Important.
Severity report

From the official docs

Questions

How do I install convex-reviewer?

Use the install box above. The skill is a single SKILL.md. Run it with /convex-reviewer in Claude Code or $convex-reviewer in Codex, or ask Claude to review your Convex functions.

Does it change my code?

Its workflow ends with a report: findings by severity, why each matters and a suggested fix. It bundles no scripts.

What counts as Critical?

A missing auth check. SKILL.md says any unauthenticated public mutation is a data-loss risk. It rates the other listed rules, such as .filter() on queries and missing validators, as Important.

How is it different from convex-authz?

convex-reviewer is a broad three-pass review. convex-authz's SKILL.md describes a narrow authorization pass that scans four bug shapes and edits your code, and says to hand performance, schema and validator findings to convex-reviewer.

Is it safe?

Its workflow ends in a report, and the skill bundles no scripts. Reading your convex/ code means the assistant sees your function logic. Our advice: review any suggested fix before you apply it.

Is it official?

Yes. It is in Convex's own agent-skills repo, and Convex's docs list it among the agent skills Convex provides.

Does it work in the Claude app?

The README and Convex docs name Claude Code, Cursor, VS Code with GitHub Copilot, Windsurf and Codex. They do not name the Claude app, and this skill works on a local project, so we list no Claude app install.

Information

updated Nov 2, 2026

Repository: convex/agent-skills
Folder: skills/convex-reviewer

convex/agent-skills skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 4

convex/agent-skills README · github.com
Convex docs: Agent Skills · docs.convex.dev
convex-reviewer SKILL.md · github.com
convex-authz SKILL.md · github.com