CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

convex-deploy-guard

Classify + announce the target Convex deployment before any deployment-affecting command; fresh explicit consent for prod actions; session read-only mode.

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

The canonical home for this skill is convex-deploy-guard in openclaw/clawhub

SKILL.md
Quality
Evals
Security

Quality

Content

92%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

An exemplary short instruction-only guard skill: dense with exact commands, flags, and file paths, structured as a clear identify-then-act workflow with validation gates and an error-recovery loop. The only minor inefficiency is that the Rules section reiterates several workflow steps, which could be consolidated.

DimensionReasoningScore

Conciseness

The body is lean and imperative (~25 lines) with no explanation of concepts Claude already knows; the only trimmable material is the brief incident-rationale intro ("most incidents start with a command aimed at the wrong one") and the Rules section substantially restating workflow steps 3-6. Not 5 because that Workflow/Rules duplication could be tightened; not 3 because there is no padding or unnecessary conceptual explanation.

4 / 5

Actionability

Fully concrete and executable: exact env vars and files to read (`CONVEX_DEPLOYMENT` in .env.local, `convex.json`), exact commands (`npx convex run --prod`, `npx convex env list`), exact MCP flags (`--deployment dev`, `--cautiously-allow-production-pii`, `--dangerously-enable-production-deployments`, `--disable-tools run,envSet,envRemove`), a concrete classification taxonomy, and a copy-paste announcement format (`target: dev (joyful-capybara-123, personal dev)`). Not 4 because the enumerated commands and flags cover the common deployment-affecting cases with no significant gaps.

5 / 5

Workflow Clarity

Clear numbered sequence (IDENTIFY → ANNOUNCE → consent → MCP defaults → read-only → diagnosis → ambiguity) with explicit validation checkpoints ("If two sources disagree, resolve before proceeding"; "Ambiguity = stop... never guess") and a genuine error-recovery feedback loop (a deploy that "didn't change anything" means re-run step 1, not re-deploy). Not 4 because both the checkpoints and the recovery loop are present for this destructive-operation context, satisfying the feedback-loop requirement.

5 / 5

Progressive Disclosure

The skill is under 50 lines, needs no external references (no references/, scripts/, or assets/ files exist in the bundle), and is well organized into a Workflow section and a Rules section with no dangling references. Per the rubric's guideline for short self-contained skills, well-organized sections alone earn the top score; not 4 because there is no content that belongs in a separate file.

5 / 5

Total

19

/

20

Passed

Description

78%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, distinctive description that names concrete actions in a well-defined niche. Its main weakness is the absence of an explicit 'Use when...' trigger clause and natural-term synonyms, which leaves the activation conditions implicit in the operational 'before any deployment-affecting command' phrasing.

Suggestions

Add an explicit trigger clause, e.g., 'Use when the user asks to deploy, run functions, or change env on a Convex project, or mentions dev/preview/production deployments.'

Include the natural synonyms users actually say — 'production' (not just 'prod'), 'npx convex deploy', 'preview' — to broaden trigger-term coverage.

Briefly mention the MCP prod-flag safety split (read-only vs mutating prod flags) so the description covers the skill's full protective scope.

DimensionReasoningScore

Specificity

Lists several concrete actions — "Classify + announce the target Convex deployment before any deployment-affecting command", "fresh explicit consent for prod actions", "session read-only mode" — anchored to a specific domain. Not 3 because it names more than 1-2 actions; not 5 because notable behaviors from the body (MCP prod-flag risk splitting, wrong-deployment diagnosis) are absent, leaving minor gaps in coverage.

4 / 5

Completeness

The 'what' is clear (classify, announce, consent-gate, read-only) and a 'when' is explicitly stated ("before any deployment-affecting command"), so it exceeds the weakly-implied level of 3. Not 5 because there is no 'Use when...' clause or concrete user-trigger phrasing (e.g., 'Use when the user asks to deploy to Convex or run convex commands against prod'), so the when could be more explicit.

4 / 5

Trigger Term Quality

Contains the natural terms a user would say — "Convex", "deployment", "prod", "read-only" — plus the "deployment-affecting command" framing. Not 5 because common synonyms and variations ("production", "npx convex deploy", "preview", "dev") are missing; not 3 because the core natural vocabulary is present, not just technical jargon.

4 / 5

Distinctiveness Conflict Risk

Occupies a clear niche — guarding "the target Convex deployment" with prod consent-gating and read-only session semantics — that no generic skill description would collide with. Not 4 because even closely related Convex deployment skills would not trigger for this description's specific guard framing; conflict risk is minimal.

5 / 5

Total

17

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

FacundoLucci/autonomous-buyer

Path

.claude/skills/convex-deploy-guard/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.