convex-verify Skill for Claude Code: What It Does and How to Install It

Makes Claude test a Convex feature as different fake users, including checks that the wrong user is refused.

Installs: 38.3K; on skills.sh
Stars: 68; on GitHub
Updated: Oct 2026; last repo commit

This skill makes Claude test a Convex feature in-process with convex-test, with no deployment needed. It seeds rows for the owner and for a second user, then calls the function as the owner, as a different signed-in user and as an anonymous caller. It checks what should work and, more importantly, what should be refused.

It sets up convex-test, vitest and @edge-runtime/vm as dev dependencies and writes a vitest.config.ts with the edge-runtime environment. SKILL.md says that config is required, or convexTest(schema) fails with import.meta.glob is not a function. It runs npx vitest run. If a refusal check fails it reports an authorization hole and hands the fix to convex-authz. Its folder holds only SKILL.md.

Good for

Convex developers who want proof that a new feature enforces who can do what
Reviewers looking for authorization holes before shipping

Install convex-verify

Claude Code

Copy this prompt.

Install the convex-verify skill in Claude Code. Run this command:

npx skills add https://github.com/convex/agent-skills --skill convex-verify

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Requires Node.js.

SKILL.md names no other skill it needs. It also mentions convex-test, convex-authz and convex-expert as optional hand-offs; install those separately if you want them. Convex's docs say the skills CLI installs skills into .agents/skills/ in your project. The "All Convex skills" command installs every skill in the repo, which has 33 skill folders. One of them, convex-improve-convex-plugin, is listed in the Convex docs as sending your coding session's transcript to the Convex team. Run this skill with /convex-verify in Claude Code or $convex-verify in Codex, or let the agent pick it when the task fits. This skill works on your project folder, so this page offers no Claude app upload route.

Built from the package data we hold. Not yet tested by us.

What's in the skill

When it loads

Prove a Convex feature works — seed, drive as multiple mocked users via convex-test, assert behavior including the negative authz cases (wrong user refused, data-scope enforced).

Sections in SKILL.md

Workflow
Rules

Key facts

Author: Convex (GitHub organisation convex; the vendor's own repo)
License: Apache-2.0 (stated in the README and the LICENSE file)
Installs on skills.sh: 38,275 (Nov 2, 2026)
GitHub stars: 68 for the whole convex/agent-skills repo (Nov 2, 2026)
Last repo commit: Oct 29, 2026
Audits on skills.sh: Gen Agent Trust Hub: pass, Socket: pass, Snyk: pass
What it includes: 1 file: SKILL.md (the repo tree lists nothing else in the folder)
Part of: The convex/agent-skills repo: 33 skill folders in the tree. The README names 6 skills, and this one is not among them

What it includes

Picks the exported query, mutation or action and the rules for who may call it
If the intent is unclear, it asks one focused question.
Read · Identify the feature
Adds convex-test, vitest and @edge-runtime/vm and writes vitest.config.ts
The config sets the edge-runtime environment and inlines convex-test.
Runs code · Set up convex-test
Inserts the caller's rows and a second user's rows, using the app's own functions
Falls back to t.run with ctx.db.insert for fixtures the public API cannot create.
Write · Seed realistic data
Calls the function with t.withIdentity as owner, as another user and with no identity
It uses the identity shape your app really uses, such as subject and tokenIdentifier.
Drive it as different users
Checks the owner succeeds, others are refused and lists show only the caller's rows
A feature is not proven until the wrong caller is shown to be blocked.
Try: “Prove my new cancelOrder mutation only works for the owner”
Assert behaviour
Runs npx vitest run, lists what passed and any failed check as a finding
Runs code · Run the tests and report
Never weakens a test to turn it green; hands the fix to convex-authz or convex-expert
A failing refusal check is treated as a real defect.
Hold the line on failures

From the official docs

Permissions

Medium risk

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

It installs packages and edits your project
It adds three dev dependencies and writes a config file and tests. Review the package changes and the diff. github.com
It will not weaken a failing check
SKILL.md says not to change a test until it is green, and to treat a failing refusal check as a defect in the function. github.com

Security advisories

No published security advisories as of Nov 2, 2026.

Technical details

Turning on read-only	SKILL.md defines no read-only mode.
Sign-in and keys	SKILL.md names no credentials.
Scopes	Installs dev dependencies (convex-test, vitest, @edge-runtime/vm) Writes vitest.config.ts and test files in your project Runs npx vitest run, which executes your Convex functions against test data

Questions

What does convex-verify do?

It makes Claude write and run convex-test tests for a Convex feature you just built. The tests call it as the owner, as another user and as an anonymous caller, and check that the right people succeed and the wrong ones are refused.

Does it need a Convex deployment?

SKILL.md says the tests run in-process with convex-test, so no deployment is needed.

What does it install in my project?

convex-test, vitest and @edge-runtime/vm as dev dependencies, and a vitest.config.ts that sets the edge-runtime environment and inlines convex-test. SKILL.md says without that config, convexTest(schema) fails at runtime.

What if a check fails?

SKILL.md treats a failed refusal check as a real authorization hole found before shipping. Claude reports it, emits a finding and hands the fix to convex-authz or convex-expert, and does not edit the test until it passes.

How do I install it?

Use the install box at the top of this page. SKILL.md names no other skill it needs to run. It composes with a test capability and hands failures to convex-authz or convex-expert. Our reading: the test capability is the repo's convex-test skill. Install those separately if you want them. Run it with /convex-verify in Claude Code or $convex-verify in Codex.

Is it safe?

It installs dev dependencies and writes test and config files in your project, then runs vitest. Review the diff and the package changes. Our advice: run it on a branch.

How is it different from convex-test?

SKILL.md says setting up a test framework in general is the test capability. convex-verify proves one specific feature you just built, with the negative checks.

Is it official?

It is in the convex/agent-skills repo under the Convex GitHub organisation, which is the vendor's own repo.

Information

updated Nov 2, 2026

Repository: convex/agent-skills
Folder: skills/convex-verify

convex/agent-skills skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 4

convex/agent-skills README · github.com
skills CLI commands · github.com
Convex docs: Agent Skills · docs.convex.dev
convex-verify SKILL.md · github.com