The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes npx tsc --noEmit to perform a post-hardening verification. This ensures that the code modifications adhere to the project's TypeScript definitions and do not introduce syntax errors.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted application source code located within the convex/ directory.
Ingestion points: Application source files (convex/**/*.ts) are ingested for analysis and refactoring.
Boundary markers: The skill relies on deterministic regex scanning (e.g., matching specific argument shapes and function signatures) rather than unstructured interpretation, which limits the potential for adversarial code to influence the agent's logic.
Capability inventory: The skill performs file system reads and writes to implement fixes, and executes the npx CLI for verification.
Sanitization: The skill verifies the existence of a valid auth.config.ts and a subject-keyed users table before applying enforcement logic, filtering out applications where such checks would be non-functional.
[SAFE]: The skill incorporates a 'Mandatory First Step' safety check that ensures an authentication foundation exists before injecting authorization enforcement. This prevents the common pitfall of creating broken or 'fail-open' security checks in unconfigured environments.

convex-authz