Audit and harden a Convex app's authorization: identity-from-arg impersonation, missing per-document ownership checks, public queries leaking data by a client-supplied id, and writes into a parent/container the caller doesn't own. Scans for the 4 shapes, applies requireIdentity/requireOwner, verifies with tsc. TRIGGER on 'secure my app', 'audit auth/authz', 'who can access this data'.
Install
npx skills add convex/agent-skills --skill convex-authznpx skills add convex/agent-skills --skill convex-authz -a claude-code -gnpx skills add convex/agent-skills --skill convex-authz -a codex -ggemini skills install https://github.com/convex/agent-skills.git --path skills/convex-authzgh skill install convex/agent-skills convex-authzgit clone --depth 1 https://github.com/convex/agent-skills /tmp/convex__agent-skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/convex__agent-skills/skills/convex-authz ~/.claude/skills/convex-authz # Claude Code
cp -R /tmp/convex__agent-skills/skills/convex-authz ~/.agents/skills/convex-authz # Codex, Cursor, Gemini CLI, Copilot, OpenCode