스킬 convex-auth

📦

convex-auth

Name: convex-auth
Author: get-convex

콘텐츠 리비전 r1 높은 위험 ⚡ 스크립트 포함⚙️ 외부 명령어🌐 네트워크 접근🔑 환경 변수

Add Convex Authentication to Your App

Convex authentication can fail silently when server and client configuration diverge. This skill wires providers, keys, configuration, UI, and verification steps.

지원: Claude Codex Code(CC)

⚠️ 38 나쁨

Maintain this Skill? Claim it ⚠️ 38 나쁨

설치 전에 중지하고 확인을 요청하세요.

계획을 검토하고 파일을 변경하기 전에 사용자의 명시적 동의를 받으세요.

내 에이전트로 설치

이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.

에이전트 요청

Review the Skillstore skill "convex-auth" from https://skillstore.io/skills/get-convex-convex-auth.md and its manifest at https://skillstore.io/api/skills/get-convex-convex-auth/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.

에이전트가 읽기 쉬운 리소스

AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.

Markdown 상세 GET /skills/get-convex-convex-auth.md 서명된 manifest GET /api/skills/get-convex-convex-auth/manifest 서명된 lockfile GET /api/skills/get-convex-convex-auth/lockfile

테스트해 보기

"convex-auth" 사용 중입니다. Add passkey authentication to this Convex application.

예상 결과:

Passkey authentication is configured on the server and client. Required deployment variables are set, protected routes are wired, and sign-in is verified.

"convex-auth" 사용 중입니다. Why does this application remain signed out after login?

예상 결과:

The audit identifies a missing or incorrect auth.config.ts entry, updates provider wiring, and confirms that authenticated state now persists.

"convex-auth" 사용 중입니다. Switch this application from passkeys to Google OAuth.

예상 결과:

The provider configuration now uses Google OAuth. Existing client components are preserved, required credentials are listed, and the sign-in flow is tested.

보안 감사

높은 위험

v1 • 2026. 9. 7. 버전별 보고서 열기

Eight findings are confirmed because package execution and JWT secret handling create project, supply-chain, and credential-exposure risks. Six findings are false positives caused by Markdown, a fixed import, an illustrative localhost URL, or misclassified prose. No prompt injection or malicious intent was found.

스캔된 파일

분석된 줄 수

검토 항목

오탐 무시됨

확인된 보안 우려 사항 (1)

높음

SKILL.md:17

Crypto seed/private key mention

node -e 'import("jose").then(async({generateKeyPair,exportPKCS8,exportJWK})=>{const k=await generate

The command generates an actual JWT signing private key and stores it in a local plaintext file. This is genuine sensitive-key handling.

기능 검토 항목 (7)

이 스킬에 대해 예상될 수 있는 실제 로컬 기능이므로 검토가 필요하지만, 확인된 악의적 동작으로는 집계되지 않습니다.

높음

SKILL.md:18

Ruby/shell backtick execution

Then set JWT_PRIVATE_KEY and JWKS (from .auth-keys.json) plus SITE_URL on the deployment. Prefer the

The CLI fallback places JWT private key material in process arguments. This risks exposure through process listings or shell history.

높음

SKILL.md:17

Generic API/secret keys

node -e 'import("jose").then(async({generateKeyPair,exportPKCS8,exportJWK})=>{const k=await generate

The command creates a private JWT key and redirects it into plaintext .auth-keys.json without setting restrictive permissions.

높음

SKILL.md:18

Generic API/secret keys

Then set JWT_PRIVATE_KEY and JWKS (from .auth-keys.json) plus SITE_URL on the deployment. Prefer the

The instruction reads generated key material and writes it into deployment configuration. Its CLI fallback can expose the secret in process arguments.

높음

SKILL.md:25

Generic API/secret keys

- Generate JWT_PRIVATE_KEY/JWKS with `jose` (extractable RS256; PKCS8 newlines to spaces; JWKS = {ke

The rule directs the agent to generate and deploy a JWT private key. This grants access to authentication secrets and privileged configuration.

중간

SKILL.md:14

Ruby/shell backtick execution

1. Install @convex-dev/auth (pinned build) and add it to convex.config.ts. With pnpm, also `pnpm add

The skill directs the agent to install packages, which executes lifecycle code and changes dependencies. The jose version is not explicitly pinned.

중간

SKILL.md:20

Ruby/shell backtick execution

5. Wire the client: ConvexAuthProvider, the sign-in component, and route guards. If you import shadc

The npx command downloads and executes a mutable latest package version. A compromised or changed release could run code in the project environment.

중간

SKILL.md:28

Ruby/shell backtick execution

- Install any shadcn/ui primitive you import up front (`npx shadcn@latest add ...`); a missing @/com

The npx command executes the mutable shadcn latest release. It exposes the project environment to unpinned third-party package code.

위험 요인

⚡ 스크립트 포함 (1)

SKILL.md:17

⚙️ 외부 명령어 (6)

SKILL.md:14 SKILL.md:16 SKILL.md:18 SKILL.md:20 SKILL.md:25 SKILL.md:28

🌐 네트워크 접근 (1)

SKILL.md:18

🔑 환경 변수 (4)

SKILL.md:16 SKILL.md:17 SKILL.md:18 SKILL.md:25

감사자: codex

이 보고서 공유 및 인용

버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.

버전별 보고서 열기

보고서 링크 복사

https://skillstore.io/skills/get-convex-convex-auth/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 배지

[![Skillstore security assessment](https://skillstore.io/badges/skills/get-convex-convex-auth/security.svg)](https://skillstore.io/skills/get-convex-convex-auth?utm_source=security_passport_badge)

HTML 배지

<a href="https://skillstore.io/skills/get-convex-convex-auth?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/get-convex-convex-auth/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

임베드 카드

<iframe src="https://skillstore.io/embed/skills/get-convex-convex-auth.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

학술 인용 (APA · BibTeX · CFF)

APA 인용

get-convex. (2026). convex-auth security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/get-convex-convex-auth/audits/1

BibTeX 인용

@techreport{get-convex-get-convex-convex-auth-2026,
  author = {get-convex},
  title = {convex-auth security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/get-convex-convex-auth/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "convex-auth security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "get-convex"
date-released: "2026-09-07"
url: "https://skillstore.io/skills/get-convex-convex-auth/audits/1"
identifiers:
  - type: other
    value: "skillstore:get-convex-convex-auth:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 점수

이 점수의 이유 증거 신뢰도: 중간

아키텍처

유지보수성

콘텐츠

커뮤니티

사양 준수

만들 수 있는 것

Add passkeys to a prototype

Configure passkey sign-in across the Convex server and application client, then verify the complete flow.

Integrate an OAuth provider

Add requested OAuth authentication while preserving the existing Convex application structure and route behavior.

Repair silent sign-out failures

Inspect provider wiring and auth.config.ts, then correct configuration that prevents authenticated sessions.

이 프롬프트를 사용해 보세요

Add passkey sign-in

Add passkey sign-in to my current Convex app. Configure the server, client provider, sign-in UI, route guards, and verification.

Add Google OAuth

Configure Google OAuth for this Convex app. Reuse existing UI patterns, identify required credentials, and verify successful sign-in and sign-out.

Diagnose authentication

Audit this Convex authentication setup. Find configuration mismatches, missing client wiring, unsafe key handling, and incomplete route protection.

Migrate authentication

Migrate this app to Convex Auth with minimal disruption. Preserve user flows, document credential changes, and validate protected routes end to end.

모범 사례

Use passkeys unless product requirements explicitly require password or OAuth authentication.
Store signing keys only in approved secret systems and remove temporary local key files immediately.
Verify sign-in, sign-out, session persistence, and protected route behavior before completion.

피하기

Do not omit auth.config.ts because failures can appear as persistent anonymous sessions.
Do not pass private keys through visible command arguments or commit generated key files.
Do not import missing UI primitives or execute unpinned package versions.

자주 묻는 질문

Which authentication method is the default?

Passkeys are the default. Password or OAuth providers are configured only when requested.

Does this skill create OAuth credentials?

No. You must obtain client credentials from the selected identity provider.

Why is auth.config.ts required?

It connects Convex authentication configuration correctly. Missing or incorrect settings can leave the application silently signed out.

How are JWT signing keys generated?

The workflow uses jose to generate an extractable RS256 key pair for Convex Auth.

Can this run in a headless environment?

Yes. The workflow avoids the interactive authentication wizard and uses direct key generation.

What must be verified before completion?

Confirm successful sign-in, sign-out, session persistence, and access behavior for protected routes.

개발자 세부 정보

작성자

get-convex

라이선스

MIT

Skillstore 리비전

버전 안내

작성자가 버전을 선언하지 않았습니다.

리포지토리

https://github.com/get-convex/agent-skills/tree/c41ece22681a50d326e54f30d24148a6d46d0c3c/skills/convex-auth

참조

d9e5ab86dafd32a1ddde9b8b4fde177589b55b95

유지보수 최신성

2026. 9. 8.

사용량

1 다운로드 · 0 조회

파일 구조

📄 SKILL.md