convex-security-audit

Convex Security Audit is a defensive security-review reference skill for Convex applications. It provides patterns and annotated TypeScript examples for auditing five areas: authorization logic (who can do what), data access boundaries (what data users can see), action isolation (protecting external API calls), rate limiting (preventing abuse), and protecting sensitive operations. It solves the problem of applying consistent, best-practice security checks when building or reviewing Convex backends.

The skill directs the reader to fetch the latest official Convex documentation before implementing (linking to Convex auth, production, and llms.txt resources) rather than assuming APIs. Its body is worked examples: role-based and permission-based access control helpers (requireRole, requirePermission with a role hierarchy), ownership-verified queries that avoid revealing whether a record exists, shared-resource access lists, and action isolation that reads API keys from environment variables (never hardcoded), authenticates the caller, and logs API calls for an audit trail. The guidance is defensive throughout, emphasizing least-privilege authorization, ownership checks, and not exposing secrets in responses.

Target users are Convex developers and reviewers who want to harden authorization, data-access, and external-integration code, or to run a structured security pass over an existing Convex project. The included files are a SKILL.md, an agent configuration, and a small SVG logo asset; the credential handling shown follows standard environment-variable practice with no exfiltration.