Convex Authz Auditor
Audits and hardens authorization in a Convex app: impersonation, missing ownership checks, data leaks
- Repository
- openclaw/clawhub
- Stars
- 9,546
- Licence
- MIT
- Files
- 1 file
What it does
When installed, the agent checks a Convex (TypeScript backend) app for four common access-control mistakes: functions that trust a user ID passed in by the client, database reads and writes with no ownership check, public queries that leak sensitive fields, and writes into parent containers the caller does not own. It first runs a pattern-based scan, then adds identity and owner checks where the app has a proper auth setup, and finally runs the TypeScript compiler to confirm the edits. If the app has no auth foundation, it avoids adding checks that would silently fail and instead makes privileged functions internal-only and tells the user to set up auth first.
Great for
- Developers shipping a Convex app who want a security review of who can read or change which data
- Teams preparing an app for launch that stores user-specific or sensitive records
- Reviewers who want a repeatable checklist of the four authorization shapes rather than a general code review
Skip it if
- Apps with no convex/ directory, where the skill is designed to skip; it is not useful for other backends
- Apps without an auth provider or user table: the skill will not add enforcement there and only defers the work, so it cannot make such an app secure on its own
- Anyone relying on it as a complete security audit: it covers only the four listed patterns and its regex scan can miss or misflag code
Try asking
- “Audit and harden the authorization in my Convex app”
- “Who can access this data? Check my Convex functions for missing ownership checks”
- “Secure my app: find functions that trust a userId passed from the client”
- “Check whether my mutations let users write into projects they don't own”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 1 original files, the MIT licence and an attribution note.
convex-authz.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip convex-authz.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip convex-authz.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Run it on a branch or commit first, since it rewrites function code and imports a new auth helper file.
- Set up authentication before running it on public functions; on an app without auth, expect it to only internalize privileged functions and advise next steps.
- After it runs, review the changes and test with real user accounts, because its regex scan is not a substitute for a human security review.
What's inside
- SKILL.md
Redistributed unmodified from openclaw/clawhub under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.