convex-authz

Audit and harden a Convex app's authorization: identity-from-arg impersonation, missing per-document ownership checks, public queries leaking data by a client-supplied id, and writes into a parent/container the caller doesn't own. Scans for the 4 shapes, applies requireIdentity/requireOwner, verifies with tsc. TRIGGER on 'secure my app', 'audit auth/authz', 'who can access this data'. SKIP when there is no convex/ directory.

Quality

86%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

73%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A dense, technically actionable workflow with strong validation checkpoints, hurt mainly by redundancy between the Workflow and Rules sections and a dependency on an unbundled convex-expert.md reference. Tightening the duplicated foundation-check prose and inlining or bundling the canonical pattern would lift the weaker dimensions.

Suggestions

Deduplicate the MANDATORY FIRST STEP foundation check: state it once in the Workflow and reference it from Rules rather than restating it near-verbatim.

Inline the requireIdentity/requireOwner helper implementations (or add them under references/) so the HARDEN step is copy-paste-ready instead of deferring to an unbundled content/convex-expert.md.

Break the long run-on sentences in steps 0, 1, and 2 into shorter bullet points or labeled sub-steps to reduce parenthetical density.

Dimension	Reasoning	Score
Conciseness	Mostly efficient technical content (regexes, helper signatures) that assumes Convex competence, but the MANDATORY FIRST STEP foundation check is restated near-verbatim in both Workflow step 0 and the Rules section, and several steps are long run-on sentences with heavy parenthetical asides that could be tightened.	3 / 5
Actionability	Provides concrete executable regexes, file paths (convex/model/auth.ts), helper signatures, and a verification command (npx tsc --noEmit), but the HARDEN step defers the actual code to content/convex-expert.md rather than giving copy-paste-ready helper implementations inline.	4 / 5
Workflow Clarity	Clear numbered sequence (steps 0-4) with explicit validation checkpoints (tsc --noEmit, re-run the scan to confirm 0 hits) and a feedback loop for a destructive/batch authz-hardening pass.	5 / 5
Progressive Disclosure	Well-organized into Workflow and Rules sections and signals its one external reference clearly, but content/convex-expert.md is referenced as the canonical pattern source yet is not present in any bundle directory, leaving a dangling reference the HARDEN step depends on.	4 / 5
	Total	16 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, highly specific description that clearly states what the skill does and when to use it, with concrete trigger and skip guidance in third person. Trigger-term coverage is the only mild weakness, with a narrow set of phrases.

Dimension	Reasoning	Score
Specificity	Names the domain (Convex authz) and enumerates four concrete defect shapes plus three concrete actions ('Scans for the 4 shapes, applies requireIdentity/requireOwner, verifies with tsc'), giving comprehensive coverage of specific actions.	5 / 5
Completeness	Explicitly answers both 'what' (audit/harden the four authz shapes via scan/apply/verify) and 'when' (TRIGGER on named phrases, SKIP when no convex/ directory) with concrete trigger guidance.	5 / 5
Trigger Term Quality	Includes natural user phrases ('secure my app', 'audit auth/authz', 'who can access this data') that users would plausibly say, but coverage is limited to three phrases with few synonyms or variants, leaving a few natural terms missing.	4 / 5
Distinctiveness Conflict Risk	Tightly niched to Convex authorization with shape-specific triggers and an explicit SKIP guard ('SKIP when there is no convex/ directory'), giving a clear niche with minimal conflict risk.	5 / 5
	Total	19 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: openclaw/clawhub
Path: .agents/skills/convex-authz/SKILL.md
Commit: 0180b56

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.