convex-security-check
openbooklet.com/s/convex-security-checkopenbooklet.com/s/[email protected]GET /api/v1/skills/convex-security-checkTen minute security pass over a Convex backend: public functions that should be internal, missing auth checks, unvalidated args, IDs from the client trusted without ownership checks, secrets in code. Use before merging a pull request, after adding new public functions, or when the user says 'quick security check'.
Builds AI agents on the Convex agent component: threads, messages, tools that call queries and mutations, streaming, RAG with vector search, and workflows for multi step jobs. Use when adding a chat assistant, tool calling agent, or retrieval feature to a Convex app.
Deep security review of a Convex app: authorization model, data access paths per table, HTTP action exposure, rate limiting, file storage access, scheduled function trust, and a written findings report. Use before launch, after an incident, or when the user asks for a full audit rather than a quick check.
Runs multi step work the way a careful senior engineer would. Triage before code, a short PRD in prds/, task.md kept current, docs synced after, and lessons recorded when a mistake repeats. Use when a task spans several files or steps, changes architecture, needs a plan the user can review, or when the user says "write a PRD", "plan this", "track this in task.md", or "what did we learn".
Reflection first problem solving for Convex projects: root cause before code, two candidate fixes, a 98 percent confidence bar, and changes limited to the files the request needs. Use before implementing any fix or feature, when a bug report comes in, when a previous fix did not work, or when the request is vague.
Ends every agent turn with a clear "What I need from you" section listing concrete actions the user must take, or says "Nothing needed from you right now", and logs every ask by id and session in prds/what-i-need-from-you.md. Use on every turn, especially when blocked on the user, when the next step needs a login, dashboard, key rotation, decision, file, or approval, or when finishing a task, audit, or fix.
Auto-indexed from waynesutton/builder-skills
Are you the author? Claim this skill to take ownership and manage it.
Related Skills
graceful-error-recovery
Use this skill when a tool call, command, or API request fails. Diagnose the root cause systematically before retrying or changing approach. Do not retry the same failing call without first understanding why it failed.
audience-aware-communication
Use this skill when writing any explanation, documentation, or response that will be read by someone else. Match vocabulary, depth, and format to the audience's expertise level before writing.
Refactoring Expert
Expert in systematic code refactoring, code smell detection, and structural optimization. Use PROACTIVELY when encountering duplicated code, long methods, complex conditionals, or any code quality issues. Detects code smells and applies proven refactoring techniques without changing external behavior.
Research Expert
Specialized research expert for parallel information gathering. Use for focused research tasks with clear objectives and structured output requirements.
clarify-ambiguous-requests
Use this skill when the user's request is ambiguous, under-specified, or could be interpreted in multiple ways. If proceeding with a wrong assumption would waste significant work, always ask exactly one focused clarifying question before doing anything.
structured-step-by-step-reasoning
Use this skill for any problem that involves multiple steps, tradeoffs, or non-trivial logic. Think out loud before answering to improve accuracy and transparency. Apply whenever the answer is not immediately obvious.