bjornmelin/convex-audit
skills/convex-audit/SKILL.md
Audit Convex—schema, security, runtime edges, migrations, function risk. Triggers—review, contract, remediate. Not greenfield spec (convex-feature-spec).
$ install --global
skillsauthnpx skillsauth add bjornmelin/dev-skills convex-auditInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 8, 2026, 3:16 AM235.2s7 files scanned
SKILL.md
- name:
- convex-audit
- description:
- Audit Convex—schema, security, runtime edges, migrations, function risk. Triggers—review, contract, remediate. Not greenfield spec (convex-feature-spec).
Convex Audit
Use this skill for read-first Convex audits that produce a clear remediation plan before implementation.
Workflow
- Read the repo
AGENTS.md. - Run
/home/bjorn/.codex/skill-support/bin/convex-scan inventory --cwd <repo> --out <json>. - Run
/home/bjorn/.codex/skill-support/bin/convex-scan surface --cwd <repo> --out <json>. - Run
/home/bjorn/.codex/skill-support/bin/convex-scan gaps --inventory <json> --out <json>. - Read only the references needed for the active findings:
references/security.mdreferences/schema.mdreferences/runtime-boundaries.mdreferences/migrations.md
- Validate non-trivial recommendations against current docs before finalizing.
- Output a remediation plan with file targets, risk level, and verification steps.
Use When
- The user asks for a Convex audit, security pass, schema review, or backend remediation plan.
- The repo has Convex and the main task is to assess existing architecture or implementation quality.
Do Not Use When
- The task is a new feature specification with multiple design options.
- The task is only a dependency upgrade or docs sync.
Outputs
- A concise audit summary.
- Ranked findings.
- An implementation-ready remediation checklist.
Resources
- Inventory helpers via
/home/bjorn/.codex/skill-support/bin/convex-scan references/security.mdreferences/schema.mdreferences/runtime-boundaries.mdreferences/migrations.md
Related Skills
bjornmelin/multi-model-review
development
VerifiedTrustedCommunity
Pre-PR multi-model review, parallel opus and codex exec adversarial lanes, then adversarial verification of merged findings. Read-only. Use before shipping nontrivial diffs.
3SKILL.mdUpdated Jul 23, 2026
bjornmelin/codex-review
tools
VerifiedTrustedCommunity
Independent gpt-5.6 diff review via the Codex CLI, normal or steerable adversarial with JSON findings. Use before shipping nontrivial changes.
3SKILL.mdUpdated Jul 23, 2026
bjornmelin/codex-delegate
development
VerifiedTrustedCommunity
Delegate implementation, investigation, or bulk work to gpt-5.6 codex via pinned codex exec. Use for clear-spec builds, migrations, debugging, or any task MODELS.md routes to codex.
3SKILL.mdUpdated Jul 23, 2026
bjornmelin/pre-mortem
development
VerifiedTrustedCommunity
Adversarial pre-mortem: imagine the plan failed, work backwards to surface risky assumptions + irreversible bets, then harden them. Proactively offer it (after the current request; confirm first) before a hard-to-reverse or one-way-door call (API, schema, framework, a hire), an all-upside plan, or unvalidated assumptions. Also on request.
3SKILL.mdUpdated Jul 22, 2026