Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/polarcoding85/convex-agent-skillz/convex-auth-skillnpx skills add PolarCoding85/convex-agent-skillz --skill convex-auth-skillgit clone --depth 1 https://github.com/PolarCoding85/convex-agent-skillzWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/polarcoding85/convex-agent-skillz/convex-auth-skill)<a href="https://agentmods.dev/skills/polarcoding85/convex-agent-skillz/convex-auth-skill"><img src="https://agentmods.dev/badge/skills/polarcoding85/convex-agent-skillz/convex-auth-skill.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00052 | $0.01296 |
| Opus 5 | $0.00026 | $0.00648 |
| Sonnet 5 | $0.00010 | $0.00259 |
| Haiku 4.5 | $0.00005 | $0.00130 |
Grade A, and why
convex-auth scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 206 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Convex Authentication - Core Patterns
This skill covers universal auth patterns that work with ANY authentication provider.
Auth in Functions
Access the authenticated user via ctx.auth.getUserIdentity():
import { query, mutation, action } from './_generated/server';
export const myQuery = query({
args: {},
handler: async (ctx) => {
const identity = await ctx.auth.getUserIdentity();
if (identity === null) {
throw new Error('Not authenticated');
}
// identity.tokenIdentifier - unique across providers
// identity.subject - user ID from provider
// identity.email, identity.name, etc. (if configured)
}
});
UserIdentity Fields
| Field | Guaranteed | Description |
|---|---|---|
tokenIdentifier |
✅ | Unique ID (subject + issuer combined) |
subject |
✅ | User ID from auth provider |
issuer |
✅ | Auth provider domain |
email |
Provider-dependent | User's email |
name |
Provider-dependent | Display name |
pictureUrl |
Provider-dependent | Avatar URL |
Critical: Race Condition Prevention
Problem: Queries can execute before auth is validated on page load.
Client-side: Always use useConvexAuth() from convex/react, NOT your provider's hook:
// ✅ Correct - waits for Convex to validate token
import { useConvexAuth } from 'convex/react';
const { isLoading, isAuthenticated } = useConvexAuth();
// ❌ Wrong - only checks provider, not Convex validation
const { isSignedIn } = useAuth(); // from @clerk/clerk-react
Skip queries until authenticated:
const user = useQuery(api.users.current, isAuthenticated ? {} : 'skip');
Use Convex auth components:
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 206 lines · 52 tokens per session scan A 901ed7c63171
convex-auth is a skill published in the GitHub repository PolarCoding85/convex-agent-skillz (17 stars, last pushed 6mo ago), licensed MIT. It adds 52 tokens to every session and 1,296 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
file-headers
MANDATORY for every coding agent (Claude Code, Codex, or any other) on every change-set — every applicable source file the agent creates or updates MUST start with the project's copyright/authorship header (file overview + exact author line). Use automatically whenever writing a new file or editing an existing one; do…
productivity-score
Calculate a productivity score using actual Agent Monitor metrics — session completion rates, cache efficiency (cacheread vs input), compaction pressure (baseline tokens), turn velocity (turncount / totalturndurationms), tool success ratio (PreToolUse vs PostToolUse), and the workflow intelligence API's complexity and…
budget-set
Define a spend budget for Claude Code and, optionally, create a cost alert rule that fires when usage crosses the limit, via POST /api/alerts/rules on the Agent Monitor dashboard. Reads current spend from /api/pricing/cost to size the budget sensibly and explains every rule field before writing. Use when setting a…
dashboard-status
Quick dashboard health and status overview — checks the Agent Monitor API (port 4820), reports session/agent/event counts from /api/stats, confirms WebSocket connectivity, reads the redacted hook status returned by /api/settings/info, and shows data freshness (last event timestamp). Use to verify the monitoring system…
dag-map
Render the multi-agent orchestration DAG for a session — parent→child subagent edges, tree depth, and fan-out — from the Agent Monitor workflow intelligence API. Cross-checks the orchestration dataset against the raw agent records and session detail. Use when visualizing how a session's agent structure was organized.
run-agent
Launch and supervise Claude Code or Codex through the CCAM Run API. Use when the user wants to start a monitored agent, select a model, approval policy, sandbox, or working directory, send a follow-up, inspect live output, resume a native session, or stop a dashboard-launched run.