skills.rest
openclaw
openclawOFFICIAL
Explore all skills by this author →
Website𝕏@openclawGitHub

convex-authz

Detect and fix authorization defects in Convex backend functions.

9.4k|1.5k|Updated Jan 3, 2026
Search Tags:#Authorization#convex#backend security#code hardening#ownership checks#Security audit#Access Control
One-click install
npx skills add https://github.com/openclaw/clawhub --skill convex-authz
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: convex-authz
Source: https://github.com/openclaw/clawhub/tree/main/.agents/skills/convex-authz
Command: npx skills add https://github.com/openclaw/clawhub --skill convex-authz

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Convex backends often ship with exploitable authorization gaps: identity taken from client-supplied arguments, missing per-document ownership checks, PII-leaking public queries, and writes into containers the caller does not own. This Skill finds and fixes those four defect shapes deterministically instead of relying on ad-hoc review.

Core Features & Use Cases

  • Deterministic 4-shape scan: Regex-based detection of identity-from-arg, missing-ownership-check, PII-leaking queries, and parent-reference write violations across convex*.ts files.
  • Canonical hardening: Applies the requireIdentity/requireOwner pattern from convex-expert.md to every hit, including subject-to-users-row resolution and membership checks for container writes.
  • Foundation gating: Verifies auth.config.ts and a subject-keyed users table exist before injecting ctx.auth enforcement; on foundationless apps it internalizes privileged functions and defers.
  • Use Case: Before shipping a Convex app, run the audit to find every public mutation that trusts a client-supplied userId, rewrite them to derive identity from ctx.auth, and confirm with tsc plus a clean re-scan.

Quick Start

Audit the Convex backend in this project for authorization vulnerabilities and harden every public query and mutation you flag.

Frequently Asked Questions about convex-authz

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit a Convex backend for authorization vulnerabilities?▼

Run a deterministic scan over convex*.ts for four defect shapes: identity-from-arg, missing ownership checks, PII-leaking queries, and unverified parent-reference writes. Then apply requireIdentity/requireOwner hardening and verify with tsc.

How do I fix identity-from-argument bugs in Convex mutations?▼

Replace any client-supplied userId or ownerId argument with requireIdentity(ctx), which derives the caller from ctx.auth.getUserIdentity() and throws 401 when null. Client-supplied identity arguments let any caller impersonate another user.

Can I add ctx.auth checks to a Convex app without auth configured?▼

No. Without an auth.config.ts provider and a subject-keyed users table, ctx.auth.getUserIdentity() always returns null, making enforcement non-functional. Convert privileged functions to internalQuery/internalMutation and set up auth first.

Why does comparing doc.ownerId to identity.subject fail in Convex?▼

It fails when the schema keys ownership by a users table row id rather than the raw auth subject, since an Id<"users"> never equals identity.subject. Resolve the caller's users row via the subject-keyed index and compare against user._id.

What are the limitations of this Convex authz audit?▼

It is a targeted authz pass covering four defect shapes, not a general code review; performance, schema, and validator issues are out of scope. It also skips projects without a convex/ directory and defers per-user checks on apps lacking an auth foundation.

Related Skills

Explore More Software Engineering Skills→
vanitiesvanities
5

convex-setup-auth

Configure Convex authentication and authorization with provider-specific wiring.

Community
Intermediate
GeolizeGeolize

convex-core

Guide Convex development with function syntax, validators, schema, and query patterns.

Official
Intermediate
kcrleekcrlee

convex-security-audit

Identify security weaknesses in Convex queries, mutations, and actions.

Community
Advanced
KatlyngKatlyng

convex-security-check

Audit Convex applications for authentication, function exposure, and validation risks.

Community
Advanced