A mutation such as remove = mutation({ args: { id: v.id("tasks") }, handler: async (ctx, args) => { await ctx.db.delete(args.id) } }) works fine in development, and in production it lets anyone who copies your deployment URL from the browser delete any task: every exported query, mutation and action is public. The same goes for corsRouter with allowCredentials: true and the default origins, which echoes every site's Origin back, and for a cron job that calls api.messages.send with an author of "System" that any client can also send. This skill finds those and the other Convex mistakes below before you deploy, and tells you how to fix each one.

Your agent runs a scanner on the TypeScript and JavaScript files in your convex/ folder (functions, http.ts, crons.ts, schema.ts). It knows which constructors are public and which are internal, reads handler parameters in arrow, function and method form (and named handlers declared in the same file), follows import aliases, and treats ctx.auth, getAuthUserId, auth helpers that get ctx, custom function wrappers and secret, key or code arguments as access checks, so the Convex Auth and Clerk setups from the docs come out clean. Calls to other functions through ctx.runMutation and component calls such as a rate limiter are not mistaken for auth checks, and webhook routes need a real verification call, not just a name that says webhook. It never runs your code or connects to a deployment. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach, and the rules guide links the official page behind each rule. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• C01: API keys, tokens and passwords written in Convex code: secret-named constants and properties, Authorization headers, literal fallbacks after process.env, known key formats (Stripe and Clerk secret keys, webhook secrets, OpenAI, Anthropic, GitHub, Slack, Google and AWS keys, Convex deploy keys including preview keys, self-hosted admin keys, private keys) and passwords in database URLs
• C02: a public mutation that patches, replaces or deletes a document by an ID from its arguments with no check on the caller
• C03: credentials allowed for any origin: corsRouter with allowCredentials and default, "*" or shared-host wildcard origins such as "*.vercel.app", or an Origin header echoed back with Access-Control-Allow-Credentials and no check (or only a startsWith check)

REVIEW (check before release)

• C11: a public mutation or action that never checks who is calling (saving through ctx.runMutation or calling a component does not count as a check)
• C12: a public function that reads its arguments without an args validator
• C13: api.* functions scheduled, run with ctx.runQuery / runMutation / runAction, or called by cron jobs instead of internal.*
• C14: .filter on a database query instead of an index (paginated queries excepted)
• C15: .collect() on a query with no index range
• C16: Date.now() or new Date() inside a query
• C17: an HTTP action that writes, schedules or stores files without ctx.auth, an Authorization or signature header check, or a verification call (svix, jwt, stripe constructEvent, HMAC)
• C18: ctx.db writes, scheduler calls or ctx.runMutation / runAction without await
• C19: an echoed Origin with credentials whose only check is loose or unclear (endsWith without a leading dot, includes, an unanchored regex)

What's included

• The scanner (Python 3.9+, standard library only)
• A rules guide with the reason, safer approach and official source for each rule
• A risky and a safe example Convex backend (tasks, an AI action, crons and HTTP routes), and the real report the scanner produces on the risky one

Limits

It reads each file on its own. Handlers given by name are followed only when declared in the same file. Helpers and custom function wrappers defined in other files are trusted to do the checks their names suggest, so functions built with customMutation, authedMutation or Ents, and handlers imported from other files, are not checked for missing auth or validators. Queries built across several statements, row-level security rules, and allow lists or CORS settings kept in other files are not followed, and client code, .env files and dashboard settings are not read. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 19 files: SKILL.md, the scanner in scripts/ (6 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (10 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.