Skills convex-performance-audit

📦

convex-performance-audit

Name: convex-performance-audit
Author: get-convex

Content revision r1 Safe ⚙️ External commands🌐 Network access

Audit Convex Performance Bottlenecks

Slow Convex features waste reads, trigger broad invalidations, and hide contention. This skill guides Claude, Codex, and Claude Code through targeted performance audits.

Supports: Claude Codex Code(CC)

🥉 79 Bronze

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "convex-performance-audit" from https://skillstore.io/skills/get-convex-convex-performance-audit.md and its manifest at https://skillstore.io/api/skills/get-convex-convex-performance-audit/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/get-convex-convex-performance-audit.md Signed manifest GET /api/skills/get-convex-convex-performance-audit/manifest Signed lockfile GET /api/skills/get-convex-convex-performance-audit/lockfile

Test it

Using "convex-performance-audit". A project list loads slowly and reads many documents.

Expected outcome:

The audit identifies an unbounded list read and missing storage-side filtering.
It recommends an index-backed query, smaller return shape, and sibling list review.
Verification includes equal results and lower documents read in Convex insights.

Using "convex-performance-audit". A dashboard feels sluggish after users scroll through several pages.

Expected outcome:

The review separates backend subscription cost from UI churn.
It suggests limiting live pages or using point-in-time fetching where freshness is low.
Verification checks subscription count, render frequency, and user-visible behavior.

Using "convex-performance-audit". Mutations show OCC conflicts during busy voting periods.

Expected outcome:

The audit finds a hot counter document and competing writes.
It recommends sharding the counter or scheduling non-critical bookkeeping.
Verification checks conflict rate, latency, and data correctness.

Security Audit

Safe

v7 • 7/9/2026 Open versioned report

Most static findings are false positives from Markdown code spans and Convex ctx.db examples. Two findings are confirmed because the skill instructs agents to run npx Convex CLI diagnostics, including an @latest fallback. No prompt injection, credential exfiltration intent, or malicious network behavior was found.

Files scanned

1,144

Lines analyzed

Review items

False positives ignored

Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:37

Ruby/shell backtick execution

2. If CLI insights are available, run `npx convex insights --details`. Use `--prod`, `--preview-name

The skill tells the agent to run npx convex insights --details, which executes an external CLI and may contact Convex services. This is legitimate diagnostic guidance but still needs user awareness.

Medium

SKILL.md:38

Ruby/shell backtick execution

- If the local repo's Convex CLI is too old to support `insights`, try `npx -y convex@latest insight

The fallback command npx -y convex@latest downloads and runs an npm package without an interactive npx prompt. It appears legitimate, but it is real external code execution.

Risk Factors

⚙️ External commands (17)

SKILL.md:13 SKILL.md:37 SKILL.md:38 SKILL.md:39 SKILL.md:48 SKILL.md:49 SKILL.md:50 SKILL.md:51 SKILL.md:52 SKILL.md:67 SKILL.md:78 SKILL.md:87 SKILL.md:88 SKILL.md:127 SKILL.md:128 SKILL.md:129 SKILL.md:130

🌐 Network access (1)

SKILL.md:132

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/get-convex-convex-performance-audit/audits/7?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/get-convex-convex-performance-audit/security.svg)](https://skillstore.io/skills/get-convex-convex-performance-audit?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/get-convex-convex-performance-audit?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/get-convex-convex-performance-audit/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/get-convex-convex-performance-audit.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

get-convex. (2026). convex-performance-audit security audit report (audit version 7) [Author version unspecified]. Skillstore. https://skillstore.io/skills/get-convex-convex-performance-audit/audits/7

BibTeX citation

@techreport{get-convex-get-convex-convex-performance-audit-2026,
  author = {get-convex},
  title = {convex-performance-audit security audit report (audit version 7)},
  institution = {Skillstore},
  year = {2026},
  number = {7},
  url = {https://skillstore.io/skills/get-convex-convex-performance-audit/audits/7},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "convex-performance-audit security audit report (audit version 7)"
version: "unspecified"
type: report
authors:
  - name: "get-convex"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/get-convex-convex-performance-audit/audits/7"
identifiers:
  - type: other
    value: "skillstore:get-convex-convex-performance-audit:audit:7"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Reduce Slow Query Cost

Find unbounded reads, missing indexes, large row shapes, and unnecessary joins on a hot Convex path.

Improve Reactive UI Performance

Review subscriptions, query granularity, and invalidation patterns that cause sluggish Convex screens.

Investigate Contention and Limits

Analyze OCC conflicts, large mutations, function timeouts, and transaction budget pressure.

Try These Prompts

Audit a Slow Convex Feature

Audit this Convex feature for performance. Start from the slow user flow. Identify expensive reads, writes, and verification steps.

Reduce Subscription Cost

Review this page for unnecessary Convex subscriptions. Compare live freshness needs with point-in-time reads. Suggest focused changes and tests.

Resolve OCC Conflicts

Analyze these Convex mutations for OCC conflicts. Find hot documents, broad read sets, no-op writes, and safe scheduling opportunities.

Plan a Performance Refactor

Create a Convex performance refactor plan across these related functions. Include migration risks, sibling paths, rollout order, and verification criteria.

Best Practices

Start with measured signals before proposing structural changes.
Trace sibling readers and writers that touch the same tables.
Verify behavior and performance after every optimization.

Avoid

Do not replace simple scans when the table is small and the signal is weak.
Do not add digest tables without a hot path or large row shape.
Do not switch reactive views to point-in-time reads when live freshness matters.