Convex Authz
Audit and harden a Convex app's authorization: identity-from-arg impersonation.
Works in any agent
2 static scans, 0 counted findings.
Recorded for this package revision; Edge checks the exact bundle again when your agent loads it.
What this skill does for you
Audit and harden a Convex app's authorization: identity-from-arg impersonation, missing per-document ownership checks, public queries leaking data by a client-supplied id, and writes into a parent/container the caller doesn't own. Scans for the 4 shapes, applies requireIdentity/requireOwner, verifies with tsc. TRIGGER on 'secure my app', 'audit auth/authz', 'who can access this data'. SKIP when there is no convex/ directory.
Quoted from the skill description in the pinned sourceUse it with Edge
Set up Edge for me: read getedge.cc/SKILL.md and follow it. Then use Edge to load the convex-authz skill from get-convex/agent-skills.
Paste it into Claude, ChatGPT, Codex or Cursor.
Or read the skill source first.
Security evidence
| Scanner | Date | Result | Findings |
|---|---|---|---|
| Edge static checks | 2026-09-29 | Pass | 0 |
| Edge committed-secret checks | 2026-09-29 | Pass | 0 |
Static scans check the code, not how well the skill works.
Scanner scope, raw findings and mirrored provider records
Edge static checks (Edge-run): edge-static/1.0.0. Scope: Static patterns for remote execution, credentials with network sends, obfuscation, prompt overrides, hidden Unicode, binaries and persistence. Revision: 0aa10576821c6928f6a0f498c087af4ee231536e. Raw findings: not supplied. Counted findings: .
Edge committed-secret checks (Edge-run): edge-secrets/1.0.0. Scope: Credentials committed in the skill's files (values never shown). Revision: 0aa10576821c6928f6a0f498c087af4ee231536e. Raw findings: not supplied. Counted findings: .
Socket (skills.sh mirror): Version unavailable. Scope: Not supplied by the mirrored record. Revision: not supplied. Raw findings: not supplied. Counted findings: Not supplied.
Snyk (skills.sh mirror): Version unavailable. Scope: Not supplied by the mirrored record. Revision: not supplied. Raw findings: not supplied. Counted findings: Not supplied.
Source and licence
- Repository
- https://github.com/get-convex/agent-skills
- Pinned skill file
- View source at revision
- Revision
- 0aa10576821c6928f6a0f498c087af4ee231536e
- Package hash
- sha256:87401dc7e1ede81ec32b17a1264ca8c55897c2e14ffffce32cd04a8c49a23cba
- Licence
- Apache-2.0
Files in the scanned package
| File | Size |
|---|---|
| SKILL.md | 9.0 KB |
Try Convex Authz in your agent.
Audit and harden a Convex app's authorization: identity-from-arg impersonation.