waynesutton/robel-auth
.cursor/skills/robel-auth/SKILL.md
Integrate and maintain Robelest Convex Auth in apps by always checking upstream before implementation. Use when adding auth setup, updating auth wiring, migrating between upstream patterns, or troubleshooting @robelest/convex-auth behavior across projects.
$ install --global
skillsauthnpx skillsauth add waynesutton/humanagent robel-authInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 17, 2026, 1:02 AM7.9s2 files scanned
SKILL.md
- name:
- robel-auth
- description:
- Integrate and maintain Robelest Convex Auth in apps by always checking upstream before implementation. Use when adding auth setup, updating auth wiring, migrating between upstream patterns, or troubleshooting @robelest/convex-auth behavior across projects.
Robel auth skill
Use this skill when a user asks to implement, update, or debug auth based on robelest/convex-auth.
This skill is designed to be copied into other repos.
Non negotiable upstream check before any auth change
Run this every time before proposing code or commands.
Preferred command:
bash .cursor/skills/robel-auth/scripts/check-upstream.sh
Manual checklist if script is unavailable:
- Read latest
mainREADME:https://raw.githubusercontent.com/robelest/convex-auth/main/README.md
- Read latest
releaseREADME:https://raw.githubusercontent.com/robelest/convex-auth/release/README.md
- Check branch level differences:
https://github.com/robelest/convex-auth/compare/release...main
- Read current self hosting docs if portal or static hosting is involved:
https://raw.githubusercontent.com/get-convex/self-hosting/main/INTEGRATION.mdhttps://github.com/get-convex/self-hosting
If main and release conflict, prefer the branch requested by the user. If unspecified, use release for stability and explain that choice.
Important assumptions for this skill
- Treat GitHub as source of truth every time.
- Do not assume npm package availability.
- Validate package availability at execution time.
- If npm is unavailable, use a GitHub source install pinned to a branch or commit.
- Keep all Convex code type safe and validator complete.
Clarifying questions to ask first
Ask these before editing:
- Which branch is source of truth for this task,
releaseormain. - Is this a new integration or an update to an existing auth setup.
- Which framework is used, Vite, Next.js, Expo web, or other.
- Is self hosted portal/static delivery needed now.
- Are they okay pinning dependency to a specific Git commit for reproducibility.
Install and dependency strategy
Never assume one install path.
- Try package registry lookup:
npm view @robelest/convex-auth version
- If package is unavailable or blocked, install from GitHub:
npm install github:robelest/convex-auth#release
- For deterministic builds, pin a commit SHA:
npm install github:robelest/convex-auth#<commit-sha>
If the project uses pnpm or bun, translate the same GitHub dependency pinning pattern.
GitHub OAuth setup instructions for end users
When the user asks for clearer GitHub auth onboarding text, include this guidance in the README where OAuth providers are explained.
Required link:
https://github.com/settings/developers
Recommended README content:
- Go to GitHub Developer Settings:
https://github.com/settings/developers
- Create a new OAuth App.
- Set:
- Homepage URL = app frontend URL (same as
SITE_URL) - Authorization callback URL =
https://<deployment>.convex.site/api/auth/callback/github
- Homepage URL = app frontend URL (same as
- Copy Client ID and Client Secret.
- Set Convex env vars:
AUTH_GITHUB_IDAUTH_GITHUB_SECRET
- Confirm
SITE_URLis configured. - Deploy and test sign in.
Important implementation note for this repo:
- GitHub auth should be documented with callback path
/api/auth/callback/github. - In this codebase, GitHub OAuth is conditionally enabled only when
AUTH_GITHUB_ID,AUTH_GITHUB_SECRET, andCONVEX_SITE_URLare present.
Baseline Convex wiring patterns
Always verify exact API names from upstream before coding. API names can change over time.
Core files typically involved:
convex/convex.config.tsconvex/auth.tsconvex/http.ts- frontend auth bootstrap file
Expected patterns to verify against upstream docs:
- Component registration in
defineApp() - Auth instance construction
- Exported auth helpers
- HTTP route registration method name
Do not hardcode historical method names without checking current docs first.
Migration guardrails
When upgrading existing apps:
- Snapshot current auth wiring before edits.
- Update one surface at a time, config, auth module, then HTTP routes.
- Keep old and new API mismatch notes in task output.
- Verify sign in flow and callback routes before moving on.
- Keep migrations minimal and focused to auth wiring only.
Self hosting decision point
Use get-convex/self-hosting only when:
- user asks for self hosted static assets, or
- auth portal hosting requires it in the selected upstream version.
When needed, follow the latest upstream integration docs:
https://github.com/get-convex/self-hostinghttps://raw.githubusercontent.com/get-convex/self-hosting/main/INTEGRATION.md
Output requirements for any task using this skill
Before finishing, always report:
- Retrieval timestamp for upstream docs.
- Which branch was used as source of truth and why.
- Install path selected, npm or GitHub pin, and why.
- Exact files changed.
- Exact commands the user should run next.
Never claim completion without these five items.
Source links
https://github.com/robelest/convex-authhttps://github.com/robelest/convex-auth/tree/releasehttps://raw.githubusercontent.com/robelest/convex-auth/main/README.mdhttps://raw.githubusercontent.com/robelest/convex-auth/release/README.mdhttps://github.com/get-convex/self-hostinghttps://raw.githubusercontent.com/get-convex/self-hosting/main/INTEGRATION.mdhttps://agentskills.io/home
Related Skills
waynesutton/.cursor/skills/update-project-docs
documentation
VerifiedTrustedCommunity
# Update project docs Use this skill after completing any feature, fix, or migration to keep the three core project tracking files in sync. Activate with: `@update` ## Step 1: Get real dates Run this first: ```bash git log --date=short -n 10 ``` Use actual commit dates. Never use placeholder dates or future months. ## Step 2: Update TASK.md Move completed items into `## Completed` with the date: ```markdown - [x] Feature name (YYYY-MM-DD) - [x] Sub-task detail - [x] Sub-task detail
1SKILL.mdUpdated Apr 16, 2026
waynesutton/.cursor/skills/create-prd
tools
VerifiedTrustedCommunity
# Create a PRD Use this skill before any multi-file feature, architectural decision, or complex bug fix. Activate with: `@prd` ## Location and naming - All PRDs live in `prds/` folder - File name: `prds/<feature-or-problem-slug>.md` - Extension is always `.md`, not `.prd` - Use kebab-case for the filename (e.g., `prds/adding-email-auth.md`) ## Template Copy and fill in this template: ```markdown # [Feature or problem name] ## Summary 1-2 sentence description of what this is and why it m
1SKILL.mdUpdated Apr 16, 2026
waynesutton/convex-self-hosting
development
VerifiedTrustedCommunity
Integrate Convex static self hosting into existing apps using the latest upstream instructions from get-convex/self-hosting every time. Use when setting up upload APIs, HTTP routes, deployment scripts, migration from external hosting, or troubleshooting static deploy issues across React, Vite, Next.js, and other frontends.
1SKILL.mdUpdated Apr 16, 2026
waynesutton/code-structure
development
VerifiedTrustedCommunity
Use when multiple workflows duplicate the same operational logic, when deciding what belongs in actions vs shared services, or when refactoring repeated operational blocks across domain flows. Use when adding new features that share mechanics with existing ones.
1SKILL.mdUpdated Apr 16, 2026