sc-convex-cloud — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited sc-convex-cloud (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill when the user wants to deploy, debug, or maintain a Convex Cloud (managed) backend — the online-path counterpart to /sc-convex (self-hosted on Dokploy). The repo lives at https://github.com/rahmanef63/si-coder-agent.
flowchart LR
A["/sc-convex-cloud"] --> B["scripts/deploy-cloud.js<br/>CONVEX_DEPLOY_KEY (env, never echoed)"]
B --> C["npx convex deploy<br/>→ Convex Cloud"]
C --> D["inject NEXT_PUBLIC_CONVEX_URL<br/>into the build"]
D --> E["probe *.convex.cloud<br/>/version + JWKS"]
E --> F["ready ✅"]All Convex Cloud deploys go through scripts/deploy-cloud.js. Do not instruct the user to run npx convex deploy interactively, nor to hand-set NEXT_PUBLIC_CONVEX_URL. The deploy key is passed via the script's env and never echoed. If a deploy fails, debug it with scripts/check-cloud.js and fix root cause — do not punt the Convex CLI call to the user.
CONVEX_DEPLOY_KEY — production (or preview) deploy key for the Cloud deployment. Required.CONVEX_DEPLOYMENT — optional local-dev marker written by npx convex dev. NOT used in CI.If CONVEX_DEPLOY_KEY is missing, route the user to /sc-onboarding.
npx convex deploy --cmd '<build>' inject NEXT_PUBLIC_CONVEX_URL at build time. Never hardcode the URL in two places — the --cmd injection wins.CONVEX_URL, which never reaches the browser. ALWAYS pass --cmd-url-env-var-name NEXT_PUBLIC_CONVEX_URL.env, never interpolate it into a shell command string.CONVEX_DEPLOYMENT in CI.npx convex deployment token create <name> --prod --save-env).| Variable | Format | Purpose | |
|---|---|---|---|
CONVEX_DEPLOY_KEY | `prod:<name>\ | eyJ2… or preview:…` | Authenticates npx convex deploy against the Cloud deployment (SECRET) |
CONVEX_DEPLOYMENT | prod:<name> / deployment name | Optional local-dev marker only; leave blank in CI |
All scripts live in skills/sc-convex-cloud/scripts/ (repo-relative; the usage blocks below assume this cwd). On install, this skill is symlinked into ~/.claude/skills/sc-convex-cloud/, so the same paths resolve there too.
deploy-cloud.jsRun a Convex Cloud deploy. Coupled build (default) runs the frontend build via --cmd and injects NEXT_PUBLIC_CONVEX_URL; --backend-only pushes just the backend (when Vercel runs the coupled build itself). Prints NEXT_PUBLIC_CONVEX_URL=<url> — never the deploy key.
node scripts/deploy-cloud.js \
[--build-cmd 'npm run build'] \
[--url-env NEXT_PUBLIC_CONVEX_URL] \
[--backend-only] \
[--message "deploy message"] \
[--cwd <path>]check-cloud.jsProbe a Cloud deployment's /version + /.well-known/jwks.json. Derives the URL from CONVEX_DEPLOY_KEY when --url is omitted. Prints a status table; exits 2 if any probe is not ok.
node scripts/check-cloud.js --url https://<name>.convex.cloud
# or, deriving from the prod deploy key:
node scripts/check-cloud.js| Symptom | Cause | Fix |
|---|---|---|
| Client connects to wrong backend | NEXT_PUBLIC_CONVEX_URL not injected | Ensure --cmd-url-env-var-name NEXT_PUBLIC_CONVEX_URL is set on the coupled build |
Browser shows CONVEX_URL unset | Missing NEXT_PUBLIC_ prefix override | Pass --url-env NEXT_PUBLIC_CONVEX_URL (default) — never the bare CONVEX_URL |
/.well-known/jwks.json returns 500 | @convex-dev/auth keys not configured on the Cloud deployment | Configure JWT keys on the Cloud deployment via the dashboard / env |
deploy-cloud.js exits 1 immediately | CONVEX_DEPLOY_KEY missing | Set it (route to /sc-onboarding) — never run the CLI by hand |
check-cloud.js cannot derive URL | preview key (branch-derived name not in key) | Pass --url https://<name>.convex.cloud explicitly |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.