{
  "name": "convex — 17 skills",
  "slug": "source-skills-7c9d50cd1635428755978337",
  "type": "skills",
  "category": "developer-tools",
  "example": false,
  "evidence_state": "pinned_source_listing",
  "stamp": "Pinned source listing — machine-checked",
  "summary": "Pinned source declarations and file hashes were listed.",
  "outcome": "Listed 17 skill declarations. Ran 41 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.",
  "rule_results": [
    "The retained source tree matches its acquisition manifest.",
    "Declared skill names (listing.json): add; agent; auth; billing; convex-authz; crons; design; domains; env; improve-convex-plugin; labs-quickstart; migrate; quickstart; seed; suggest; test; workflow"
  ],
  "task": "What declarations and files are present in this pinned source?",
  "setup": "Git blob acquisition followed by static source inspection.",
  "limitations": "Scope: acquisition and static inspection. Command results: commands.json.",
  "source_url": "https://github.com/get-convex/convex-backend-skill.git",
  "documentation_url": "https://github.com/get-convex/convex-backend-skill.git",
  "commit": "6ca54f6e2e7582812187b8a5a4783fb4dff52692",
  "tree_sha256": "b4cafe2c0dfbbfcf1a9d8bd7a8ded2f805ce463711415bb9d67f59c2f65a4b2f",
  "file_sha256": {
    ".claude-plugin/marketplace.json": "27f6a377b6bb205093c933d7b049cf2ee9538b41db4b4786dc3aec08a328d0ee",
    ".claude-plugin/plugin.json": "c946d958a8a0322f25284daeb7fae8320ed8e2f98de9fb5deb298aaacc685fd3",
    ".github/workflows/validate.yml": "e475e335302e7b7bb34b1479b97149305576a42c99dcf75e5109d968f9c880ae",
    ".mcp.json": "ec96ee98acca29c3258649c420e581759191839e2e8b2929f3c9e35c768c3ac2",
    "README.md": "fc0621a17005d21bc5b48dcdb95b91b0219b2013664d59b2670cafc0cedd37d0",
    "agents/convex-expert.md": "2252802afee88db8c82f76e3bcac911f1b3ce52694c8db01b1db78f88da67318",
    "agents/convex-reviewer.md": "f3fa5672d51e297962a4aae4e65e155d73ba5ee260cc90da6661d241e3076bed",
    "commands/quickstart.md": "35ef4cd352988a913a4af39956fe71e21ca78a413fb69bfcdbce0fd8080ba21b",
    "hooks/analytics.mjs": "b19a4a30291909dd43dd3ae64d7d5f242be51a3b499db58d29780ec95d9395f3",
    "hooks/convex-freshness.mjs": "095123d53d7a8ab34a643b4e411731bd0f436995e28734e26a98b73e68321ee9",
    "hooks/convex-lint.mjs": "b1d8ea04c2565290d2d25903c42700e728ef452fc651a76870367b77d512bcb6",
    "hooks/convex-lint.test.mjs": "3be4537cac483306be7fd6ad3ebbed3136ca5a4db266dcd500030c10d86b9e9c",
    "hooks/convex-typecheck.mjs": "a6e6ffeceab6fba622a0cb30d7713bc700363b06af96db52dcb3c7f253d752c3",
    "hooks/convex-typecheck.test.mjs": "254228b0eb4a28b0b0e44bfee144638325a25f29a36bc76e0a770d8236485205",
    "hooks/hooks.json": "c99e2d9a8b52620b1513ef36949d1c63c0a734d498fb6c93a4cc3ec190fb893b",
    "hooks/session-start.mjs": "34b23eca7303a4119d6999cc63d35dc7e2655c86de26d621f38da744124b876e",
    "hooks/session-start.test.mjs": "0e98b3a6256fada3cd3eafa09415542d6689214bb162b57bbb6130c7640f3cd6",
    "monitors/monitors.json": "4d8486ddac0815c3c8c184ebdccce9a02fd72df8b2e24bdbf7f0f1c9b5b013bd",
    "skills/add/SKILL.md": "029a0d39e09be7f4550996fecaaae19f48b20227cf62e92b1542d1e8e83faa91",
    "skills/agent/SKILL.md": "3efa7c2cc62d19c56fa4350ddf7c2590836aa608235f7fe16d29edb460cfc02c",
    "skills/auth/SKILL.md": "0086a9d6f4e2fbd1eab22413d9b99463b22f93fbf1b236b917d1effc410184b4",
    "skills/billing/SKILL.md": "dd100b610b077a8595e2c64ff14d3136f45d67a39555b7ba5cc54aaa28e8f7ba",
    "skills/convex-authz/SKILL.md": "ec017427739a958b7577bfde7b97e33b8e99a64f441f0f7ba7f2079b9e007a3f",
    "skills/crons/SKILL.md": "d152a0e5e2d9e96f4298f6eb08551309d1f577261e556ed4026ae0d08164a954",
    "skills/design/LICENSE.txt": "79aaec53ef1333544088fe80ecb8ec70f2b84f60c0c4157240df0911cf9696c7",
    "skills/design/SKILL.md": "7b287be123aa10096f4449b63b473b9c10a7b23b593117cb72d36698c5e68c62",
    "skills/domains/SKILL.md": "18b053c9069e79d287c9a4a58df993351cfd561ef8efe34765a2ca4913a8ce27",
    "skills/env/SKILL.md": "9480271a69aab3bbe330e38af0a3bafd7f0e1f6825163d2bacb3910c76cee980",
    "skills/improve-convex-plugin/SKILL.md": "ccbc1ccbc1988ce7ca0592ed6cb288aef6fc95bd761c65cee913080ab1f5114c",
    "skills/labs-quickstart/SKILL.md": "23332ce7c6d3462ee487eb5c2796374d0a4aeb7cb4c61a0c9444baf4fa7433f3",
    "skills/migrate/SKILL.md": "fe502b63e902be29b565be568b7577f23de6035a4a9e51158b2cfe7bb7696753",
    "skills/quickstart/SKILL.md": "ffdf43071a8a1c47ce1d8aa990567782713e52a1aa14d44b6de21af6ee60ea3c",
    "skills/seed/SKILL.md": "21f690bbc22b7ee0d511cec73552362cb44209d0bb5720641a58c6f25b79bd8a",
    "skills/suggest/SKILL.md": "3c7dffe23fb8ba140f69bd03e3b8e97ed1912813a9cbbe08a2a5f43cf9b4336e",
    "skills/test/SKILL.md": "82ac0dd31c3d82822f28f4932edfe226a9044488415383702871893e947279c0",
    "skills/workflow/SKILL.md": "0bb64f6934a4b072635135ba7763f4e095624e6816386176eb9c74e0715f9206"
  },
  "lockfiles": [
    "LOCK.json"
  ],
  "utc_date": "2026-10-18T15:09:30Z",
  "source_date": "2026-10-16",
  "discovered_date": "2026-10-16",
  "retested_date": "2026-10-18",
  "reviewed_date": "2026-10-18",
  "published_date": "2026-10-18",
  "modified_date": "2026-10-18",
  "reviewer": "machine pipeline",
  "harness_version": "toolwitness harness at commit c086df0eda39d1552f8cab383c0b4a275ced82c4",
  "claude_code_version": "Not applicable: static source inspection (commands.json).",
  "model_id": "Not applicable: static source inspection (commands.json).",
  "scanner_version": "Not applicable: static source inspection.",
  "rulepack_version": "Not applicable: static source inspection.",
  "agents": [],
  "disclaimer": "This record lists declarations and file hashes from a pinned source tree. Git command results from acquisition and static inspection are retained in commands.json. Scope: acquisition and static inspection. It is not a security or quality verdict. Changed bytes are outside this record.",
  "commands": [
    "Ran 41 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection."
  ],
  "prompt_list": [
    "Not applicable: static source inspection (commands.json)."
  ],
  "history": [
    "2026-10-18T15:09:30Z: pinned source inspection"
  ],
  "application": {
    "name": "convex — 17 skills",
    "softwareVersion": "6ca54f6e2e7582812187b8a5a4783fb4dff52692",
    "applicationCategory": "DeveloperApplication",
    "operatingSystem": "Not exercised"
  },
  "artifacts": {
    "transcript": "Ran 41 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.",
    "sinkhole_log": "Not applicable: static source inspection (commands.json).",
    "canary_log": "Not applicable: static source inspection (commands.json).",
    "scanner_output": "Not applicable: static source inspection (commands.json).",
    "normalized_text": "{\n  \"listing\": {\n    \"skills\": [\n      {\n        \"path\": \"skills/add/SKILL.md\",\n        \"name\": \"add\",\n        \"description\": \"Add a capability to the CURRENT Convex app — consults the served Convex capability catalog for always-current procedures (billing, crons, auth, agent, search, …); falls back to built-in hosting or @convex-dev component search. TRIGGER when the user runs /add, or asks to add hosting/publishing or any backend capability to an existing Convex app.\",\n        \"files\": {\n          \"skills/add/SKILL.md\": \"029a0d39e09be7f4550996fecaaae19f48b20227cf62e92b1542d1e8e83faa91\"\n        }\n      },\n      {\n        \"path\": \"skills/agent/SKILL.md\",\n        \"name\": \"agent\",\n        \"description\": \"Add an AI agent / chatbot / RAG backend on Convex with @convex-dev/agent (durable threads, messages, tools, vector search). TRIGGER when the user wants an AI assistant/chatbot/agent or 'chat with my docs' feature. Calls models through the Convex AI Gateway — no provider key to manage.\",\n        \"files\": {\n          \"skills/agent/SKILL.md\": \"3efa7c2cc62d19c56fa4350ddf7c2590836aa608235f7fe16d29edb460cfc02c\"\n        }\n      },\n      {\n        \"path\": \"skills/auth/SKILL.md\",\n        \"name\": \"auth\",\n        \"description\": \"Add authentication to the current Convex + web app — passkeys by default (OAuth/password optional), wired end to end incl. the auth.config.ts that's the #1 auth footgun. TRIGGER when the user wants login / sign-in / accounts / passkeys / OAuth for an existing app.\",\n        \"files\": {\n          \"skills/auth/SKILL.md\": \"0086a9d6f4e2fbd1eab22413d9b99463b22f93fbf1b236b917d1effc410184b4\"\n        }\n      },\n      {\n        \"path\": \"skills/billing/SKILL.md\",\n        \"name\": \"billing\",\n        \"description\": \"Add Stripe billing/payments/subscriptions to a Convex app via @convex-dev/stripe — checkout action, auto-verified webhook, server-side subscription gating. TRIGGER when the user wants payments/billing/subscriptions/a paywall/Stripe.\",\n        \"files\": {\n          \"skills/billing/SKILL.md\": \"dd100b610b077a8595e2c64ff14d3136f45d67a39555b7ba5cc54aaa28e8f7ba\"\n        }\n      },\n      {\n        \"path\": \"skills/convex-authz/SKILL.md\",\n        \"name\": \"convex-authz\",\n        \"description\": \"Audit and harden a Convex app's authorization: identity-from-arg impersonation, missing per-document ownership checks, public queries leaking data by a client-supplied id, and writes into a parent/container the caller doesn't own. Scans for the 4 shapes, applies requireIdentity/requireOwner, verifies with tsc. TRIGGER on 'secure my app', 'audit auth/authz', 'who can access this data'. SKIP when there is no convex/ directory.\",\n        \"files\": {\n          \"skills/convex-authz/SKILL.md\": \"ec017427739a958b7577bfde7b97e33b8e99a64f441f0f7ba7f2079b9e007a3f\"\n        }\n      },\n      {\n        \"path\": \"skills/crons/SKILL.md\",\n        \"name\": \"crons\",\n        \"description\": \"Set up recurring scheduled jobs (crons) on Convex — digests, cleanups, polling, retries. TRIGGER when the user wants a recurring/scheduled task ('every day/hour', cron, periodic cleanup). Targets internal functions, idempotent handlers.\",\n        \"files\": {\n          \"skills/crons/SKILL.md\": \"d152a0e5e2d9e96f4298f6eb08551309d1f577261e556ed4026ae0d08164a954\"\n        }\n      },\n      {\n        \"path\": \"skills/design/SKILL.md\",\n        \"name\": \"design\",\n        \"description\": \"Design and build reactive, type-safe, production-grade backends on Convex. Covers schema, queries/mutations/actions, indexes, auth, file storage, scheduling, real-time multiplayer, mobile backends, and LLM/agent workflows on Convex's one-platform stack.\",\n        \"files\": {\n          \"skills/design/LICENSE.txt\": \"79aaec53ef1333544088fe80ecb8ec70f2b84f60c0c4157240df0911cf9696c7\",\n          \"skills/design/SKILL.md\": \"7b287be123aa10096f4449b63b473b9c10a7b23b593117cb72d36698c5e68c62\"\n        }\n      },\n      {\n        \"path\": \"skills/domains/SKILL.md\",\n        \"name\": \"domains\",\n        \"description\": \"Wire a domain the user ALREADY OWNS (GoDaddy/Namecheap/Cloudflare/…) to their Convex app: exact DNS records, custom-domain attachment, auth-origin rebind. TRIGGER when the user owns a domain and wants it pointing at their app ('point my domain at this', 'use my own domain', 'set up example.com'). Never asks for registrar credentials.\",\n        \"files\": {\n          \"skills/domains/SKILL.md\": \"18b053c9069e79d287c9a4a58df993351cfd561ef8efe34765a2ca4913a8ce27\"\n        }\n      },\n      {\n        \"path\": \"skills/env/SKILL.md\",\n        \"name\": \"env\",\n        \"description\": \"Set + wire deployment env vars / secrets (API keys) for a Convex app — stored in Convex env, read in actions, never hardcoded. TRIGGER when the user needs an API key/secret/env var ('add my OpenAI key', 'set an env var').\",\n        \"files\": {\n          \"skills/env/SKILL.md\": \"9480271a69aab3bbe330e38af0a3bafd7f0e1f6825163d2bacb3910c76cee980\"\n        }\n      },\n      {\n        \"path\": \"skills/improve-convex-plugin/SKILL.md\",\n        \"name\": \"improve-convex-plugin\",\n        \"description\": \"Send THIS coding session's transcript (Claude Code or Codex) to the Convex quickstart backend (anteater) for an AI post-mortem that improves the whole system — the runbook, bootstrap script, and skills. Use after a quickstart run (success or failure), or whenever the user wants to \\\"send feedback\\\", \\\"report how that went\\\", or \\\"help improve the quickstart\\\".\",\n        \"files\": {\n          \"skills/improve-convex-plugin/SKILL.md\": \"ccbc1ccbc1988ce7ca0592ed6cb288aef6fc95bd761c65cee913080ab1f5114c\"\n        }\n      },\n      {\n        \"path\": \"skills/labs-quickstart/SKILL.md\",\n        \"name\": \"labs-quickstart\",\n        \"description\": \"LABS — the FULL Convex quickstart: scaffold a Next.js + shadcn app from one sentence with passkey sign-in and an in-app feedback panel pre-baked, build it live, then PUBLISH to a public convex.app URL (with the user's confirmation).\",\n        \"files\": {\n          \"skills/labs-quickstart/SKILL.md\": \"23332ce7c6d3462ee487eb5c2796374d0a4aeb7cb4c61a0c9444baf4fa7433f3\"\n        }\n      },\n      {\n        \"path\": \"skills/migrate/SKILL.md\",\n        \"name\": \"migrate\",\n        \"description\": \"Safely migrate the schema + backfill data on a deployed Convex app with @convex-dev/migrations. TRIGGER when changing the schema on a live app, backfilling data, or after a schema-validation error from a change. SKIP a fresh local app.\",\n        \"files\": {\n          \"skills/migrate/SKILL.md\": \"fe502b63e902be29b565be568b7577f23de6035a4a9e51158b2cfe7bb7696753\"\n        }\n      },\n      {\n        \"path\": \"skills/quickstart/SKILL.md\",\n        \"name\": \"quickstart\",\n        \"description\": \"Scaffold a brand-new Convex app from a one-sentence idea and build it live — a running Next.js + shadcn app with `convex dev` + `next dev` and error watchers already armed, going from idea to running app in under a minute (locally).\",\n        \"files\": {\n          \"skills/quickstart/SKILL.md\": \"ffdf43071a8a1c47ce1d8aa990567782713e52a1aa14d44b6de21af6ee60ea3c\"\n        }\n      },\n      {\n        \"path\": \"skills/seed/SKILL.md\",\n        \"name\": \"seed\",\n        \"description\": \"Seed the Convex database with starter/fixture data or import an existing dataset (CSV/JSON). TRIGGER when the user wants sample/seed data or to import a dataset into Convex. Idempotent, schema-matching.\",\n        \"files\": {\n          \"skills/seed/SKILL.md\": \"21f690bbc22b7ee0d511cec73552362cb44209d0bb5720641a58c6f25b79bd8a\"\n        }\n      },\n      {\n        \"path\": \"skills/suggest/SKILL.md\",\n        \"name\": \"suggest\",\n        \"description\": \"Proactively suggest the right Convex component when the user hand-rolls what already exists: setInterval polling → crons, counter increments → sharded-counter, .collect() counts → aggregate, email → resend, DB-counter rate limiting → rate-limiter, uploads → storage, search, presence, multi-step actions → workflow, vector DB → rag, collaborative editing → prosemirror-sync. TRIGGER on noticing the pattern in a Convex app, AFTER completing the user's request. NEVER for non-Convex code.\",\n        \"files\": {\n          \"skills/suggest/SKILL.md\": \"3c7dffe23fb8ba140f69bd03e3b8e97ed1912813a9cbbe08a2a5f43cf9b4336e\"\n        }\n      },\n      {\n        \"path\": \"skills/test/SKILL.md\",\n        \"name\": \"test\",\n        \"description\": \"Generate tests for Convex functions with convex-test (queries/mutations/auth/scheduling, in-memory). TRIGGER when the user wants tests / a test suite for their Convex backend / 'how do I test this'.\",\n        \"files\": {\n          \"skills/test/SKILL.md\": \"82ac0dd31c3d82822f28f4932edfe226a9044488415383702871893e947279c0\"\n        }\n      },\n      {\n        \"path\": \"skills/workflow/SKILL.md\",\n        \"name\": \"workflow\",\n        \"description\": \"Build a durable multi-step pipeline on Convex where each step runs in order and is retried independently on failure (transcribe→summarize→email, ETL, order fulfillment, any 'do A then B then C, retry each' job). Use @convex-dev/workflow — do NOT hand-roll a chain of scheduler calls or a custom jobs table. TRIGGER on multi-step / pipeline / 'retry each step' / long-running orchestration requests.\",\n        \"files\": {\n          \"skills/workflow/SKILL.md\": \"0bb64f6934a4b072635135ba7763f4e095624e6816386176eb9c74e0715f9206\"\n        }\n      }\n    ],\n    \"hooks\": [\n      {\n        \"path\": \"hooks/hooks.json\",\n        \"sha256\": \"c99e2d9a8b52620b1513ef36949d1c63c0a734d498fb6c93a4cc3ec190fb893b\",\n        \"event\": \"SessionStart\",\n        \"matcher\": null,\n        \"declaration\": {\n          \"type\": \"command\",\n          \"command\": \"node \\\"${CLAUDE_PLUGIN_ROOT}/hooks/session-start.mjs\\\"\"\n        },\n        \"executed\": false\n      },\n      {\n        \"path\": \"hooks/hooks.json\",\n        \"sha256\": \"c99e2d9a8b52620b1513ef36949d1c63c0a734d498fb6c93a4cc3ec190fb893b\",\n        \"event\": \"SessionStart\",\n        \"matcher\": null,\n        \"declaration\": {\n          \"type\": \"command\",\n          \"command\": \"node \\\"${CLAUDE_PLUGIN_ROOT}/hooks/convex-freshness.mjs\\\"\",\n          \"timeout\": 10\n        },\n        \"executed\": false\n      },\n      {\n        \"path\": \"hooks/hooks.json\",\n        \"sha256\": \"c99e2d9a8b52620b1513ef36949d1c63c0a734d498fb6c93a4cc3ec190fb893b\",\n        \"event\": \"PreToolUse\",\n        \"matcher\": \"Write|Edit|MultiEdit\",\n        \"declaration\": {\n          \"type\": \"command\",\n          \"command\": \"node \\\"${CLAUDE_PLUGIN_ROOT}/hooks/convex-lint.mjs\\\"\"\n        },\n        \"executed\": false\n      },\n      {\n        \"path\": \"hooks/hooks.json\",\n        \"sha256\": \"c99e2d9a8b52620b1513ef36949d1c63c0a734d498fb6c93a4cc3ec190fb893b\",\n        \"event\": \"Stop\",\n        \"matcher\": null,\n        \"declaration\": {\n          \"type\": \"command\",\n          \"command\": \"node \\\"${CLAUDE_PLUGIN_ROOT}/hooks/convex-typecheck.mjs\\\"\",\n          \"timeout\": 180\n        },\n        \"executed\": false\n      }\n    ],\n    \"executions\": []\n  }\n}"
  },
  "review_input": {
    "identity_artifact": "identity.json",
    "evidence_sha256": {
      "LOCK.json": "08e34fbd715d0694f720b61d28b7a5d8c689b65655fbaf60aaa15ae467c33003",
      "commands.json": "9b6a62ed143964b2d7c367c4627cac4d6c05672427b0a5e37c368f96fb379810",
      "complete.json": "91b504b43905fdc009504d516c45eea831f39a1995b9e7d69987c9756c936d6f",
      "identity.json": "5d01d07d65737027434a1201db9c29c1d991f786cb648eed0d626321fffb11e5",
      "listing.json": "fcb62911119929c4d12f41fee3cadc3e62078723e5983eb428439c5fe62a2f46",
      "selection.json": "0ee6cf5e2f4ac80ffc4bfc9e72e290a9fb8ed9071f6f87aa9ccbfb1f0280b786"
    },
    "claims": [
      {
        "id": "acquired",
        "field": "summary",
        "text": "Pinned source declarations and file hashes were listed.",
        "sources": [
          "LOCK.json",
          "listing.json",
          "commands.json"
        ]
      },
      {
        "id": "listed",
        "field": "outcome",
        "text": "Listed 17 skill declarations. Ran 41 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.",
        "sources": [
          "LOCK.json",
          "listing.json",
          "commands.json"
        ]
      },
      {
        "id": "tree",
        "field": "rule_results.0",
        "text": "The retained source tree matches its acquisition manifest.",
        "sources": [
          "LOCK.json",
          "listing.json",
          "commands.json"
        ]
      },
      {
        "id": "declared",
        "field": "rule_results.1",
        "text": "Declared skill names (listing.json): add; agent; auth; billing; convex-authz; crons; design; domains; env; improve-convex-plugin; labs-quickstart; migrate; quickstart; seed; suggest; test; workflow",
        "sources": [
          "LOCK.json",
          "listing.json",
          "commands.json"
        ]
      }
    ]
  },
  "review": {
    "kind": "machine-checked",
    "date": "2026-10-18",
    "reviewed_sha256": "0b64c77f7c7a23f0dc29268c61c7b2c4f88136aa99cc6a2a2b31614f449b394e",
    "gates": "0e5792eb8d95dcc6a1808c6fc2dc32689c399b05e22cbe7f2971dd60e0026a2c",
    "codex": "121bb45a9ef18b9afd68f98171d3215975328732d59fb50d8b6c57e40aca7085",
    "grok": "f1ead48dc138dc00ccef1c1e4767036941fee69a617b88854ae6662afdc844a9",
    "summary": "Deterministic gates passed; every claim rebuilt from evidence with a reviewed template; Grok reported no standing refutation."
  }
}