New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Convex Deploy Guard

by openclaw in openclaw/clawhub

Classify + announce the target Convex deployment before any deployment-affecting command; fresh explicit consent for prod actions; session read-only mode.

MITAuto-check: notesDevOps & Cloud

Install Convex Deploy Guard

skills CLI
$ npx skills add openclaw/clawhub --skill convex-deploy-guard -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install openclaw/clawhub convex-deploy-guard --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/openclaw/clawhub.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.agents/skills/convex-deploy-guard .claude/skills/convex-deploy-guard && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
convex-deploy-guard
GitHub stars
9.5k
Token cost
~885 tokens
SKILL.md length
462 words
Files
1
Skills in repo
56
Repo updated
First seen
Licence
MIT

At a glance

Classify + announce the target Convex deployment before any deployment-affecting command; fresh explicit consent for prod actions; session read-only mode.

  • Works in 7 steps: IDENTIFY before you act: read… → ANNOUNCE in one line before any… → PROD needs a FRESH explicit yes: before… → …
  • Tasks that involve Deployment
  • SKILL.md covers Workflow and Rules
  • Calls npx; needs CONVEX_DEPLOY_KEY

What it does

Convex Deploy Guard is an agent skill from openclaw/clawhub. Classify + announce the target Convex deployment before any deployment-affecting command; fresh explicit consent for prod actions; session read-only mode.

Its SKILL.md is about 890 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in DevOps & Cloud, covering Deployment. It works with Model Context Protocol. The repository describes itself as: Skill + Plugin Registry for OpenClaw. The licence is MIT.

When your agent uses it

  • Tasks that involve Deployment

Example prompts

  • “/convex-deploy-guard”

Requirements

  • Node.js
  • A credential in CONVEX_DEPLOY_KEY

Workflow steps

7 steps, taken from the first numbered list in SKILL.md.

  1. IDENTIFY before you act: read CONVEX_DEPLOYMENT in .env.local, convex.json, and whether CONVEX_DEPLOY_KEY is set; or call the official…
  2. ANNOUNCE in one line before any deployment-affecting command: target: dev (joyful-capybara-123, personal dev). Never run the command in…
  3. PROD needs a FRESH explicit yes: before npx convex deploy (when it resolves to prod), npx convex run --prod, env set on prod, snapshot…
  4. MCP safety defaults: start the official MCP scoped non-prod (--deployment dev). The two prod flags are DIFFERENT risk levels — keep them…
  5. READ-ONLY session mode: when the user says 'read-only' / 'don't change anything', honor it absolutely for the rest of the session — no…
  6. Wrong-deployment diagnosis: when a deploy 'didn't change anything', do NOT re-deploy harder. Re-run step 1 — the deploy almost certainly…
  7. Ambiguity = stop: if you cannot determine which deployment a command will hit, find out (status tool; compare npx convex env list…

What it can do on your machine

Read from SKILL.md and the folder at commit c23e34a. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • npx

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md. Its commands use npx, which can reach the network depending on how they are called.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names these keys or tokens, usually read from environment variables:

    • CONVEX_DEPLOY_KEY

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Convex Deploy Guard loads about 885 tokens when it runs. Until then it costs about 44 tokens; SKILL.md has 462 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~44
When it runs · the whole SKILL.md, loaded when a task matches
~885

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check: notes

The automated check noted patterns worth knowing about, such as sudo or a known installer.

  • NoteMentions a .env fileSKILL.md:14
    ore you act: read `CONVEX_DEPLOYMENT` in .env.local, `convex.json`, and whether `CONVEX_DEPLOY_KEY` is set; or call the

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from openclaw/clawhub at commit c23e34a, republished under its MIT licence (© openclaw). 462 words, ~885 tokens.

Download SKILL.mdSave it as .claude/skills/convex-deploy-guard/SKILL.md (or your agent's skills folder).
name
convex-deploy-guard
description
Classify + announce the target Convex deployment before any deployment-affecting command; fresh explicit consent for prod actions; session read-only mode.
<!-- GENERATED from convex-agents content/capabilities/deploy-guard.json — do not edit by hand. -->

Deployment target guard

Deployments are not interchangeable, and most incidents start with a command aimed at the wrong one. Every Convex project has several (personal dev, preview, prod — often across multiple projects on one machine). This guard is the standing discipline: identify, announce, then act — and treat prod as consent-gated, per action, per session.

Workflow

  1. IDENTIFY before you act: read CONVEX_DEPLOYMENT in .env.local, convex.json, and whether CONVEX_DEPLOY_KEY is set; or call the official Convex MCP status tool. Classify the target: local-anonymous | dev | preview | prod. If two sources disagree, resolve before proceeding.
  2. ANNOUNCE in one line before any deployment-affecting command: target: dev (joyful-capybara-123, personal dev). Never run the command in the same breath as discovering the target — announce first.
  3. PROD needs a FRESH explicit yes: before npx convex deploy (when it resolves to prod), npx convex run --prod, env set on prod, snapshot import/export on prod, or starting the MCP with prod access — state exactly what will change on which deployment and get an explicit yes in THIS session. A yes given earlier, or for a different target, does not carry.
  4. MCP safety defaults: start the official MCP scoped non-prod (--deployment dev). The two prod flags are DIFFERENT risk levels — keep them split: a read-only prod audit (advisor/insights reading data/logs/insights) passes ONLY --cautiously-allow-production-pii (read tools); --dangerously-enable-production-deployments (which enables MUTATING prod tools) stays OFF unless the user explicitly asked to CHANGE prod this session. Never pair them by default — 'look at prod' must not silently grant 'mutate prod'.
  5. READ-ONLY session mode: when the user says 'read-only' / 'don't change anything', honor it absolutely for the rest of the session — no deploy, no env set/remove, no mutations via run, no imports; start the MCP with --disable-tools run,envSet,envRemove.
  6. Wrong-deployment diagnosis: when a deploy 'didn't change anything', do NOT re-deploy harder. Re-run step 1 — the deploy almost certainly landed on a different deployment than the one being observed.
  7. Ambiguity = stop: if you cannot determine which deployment a command will hit, find out (status tool; compare npx convex env list fingerprints) — never guess.
Show full SKILL.md (119 more words)Show less

Rules

  • Classify and announce the target BEFORE every deployment-affecting command — identification and action are two separate steps.
  • Prod consent is per-action, per-target, per-session: state what changes where, get a fresh explicit yes.
  • Keep the two prod MCP flags split by risk: --cautiously-allow-production-pii (read-only) for an audit; --dangerously-enable-production-deployments (mutating) only when the user explicitly asks to change prod. Both are user-spoken-only; default every MCP start to a non-prod deployment selector.
  • Read-only mode, once requested, is absolute for the session — including 'harmless' mutations.
  • A deploy that seemed to do nothing means the WRONG deployment changed — diagnose the target, don't re-run.
  • This guard composes: ship, env, migrate, and seed run it as their step 0; it is not itself a deploy tool.

© openclaw, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in .agents/skills/convex-deploy-guard of openclaw/clawhub.

Open the folder on GitHubat commit c23e34a

Compare with similar skills

Convex Deploy Guard next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Convex Deploy Guard compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Convex Deploy Guard this skillopenclaw/clawhub9.5k—~885Automated safety check: NotesMIT
AWS Cdk Developmentzxkane/aws-skills3672 repos~2.5kAutomated safety check: PassMIT
Prepare Cloudflare Production DeploymentLubomirGeorgiev/cloudflare-workers-nextjs-saas-template786—~5.9kAutomated safety check: NotesMIT
Deploy Observabilityaliyun/alibabacloud-observability-mcp-server166—~2.6kAutomated safety check: NotesNone
Release Allpaperboytm/spool592—~1.1kAutomated safety check: PassCustom licence
Deploynoskillish/bankmcp276—~744Automated safety check: PassMIT

Similar skills

  • AWS Cdk Development

    zxkane/aws-skills

    AWS Cloud Development Kit (CDK) expert for building cloud infrastructure with TypeScript/Python.

    367 GitHub starsUsed in 2 repos~2.5k tokens
    DevOps & CloudAuto-check passed

  • Prepare Cloudflare Production Deployment

    LubomirGeorgiev/cloudflare-workers-nextjs-saas-template

    Source-of-truth runbook for preparing this Vinext Cloudflare Workers SaaS template for production deployment.

    786 GitHub stars~5.9k tokensUpdated yesterday
    DevOps & CloudAuto-check: notes

  • Deploy Observability

    aliyun/alibabacloud-observability-mcp-server

    Deploy, start, and update the Alibaba Cloud Observability MCP Server (阿里云可观测 MCP Server).

    166 GitHub stars~2.6k tokensUpdated 1 mo ago
    DevOps & CloudAuto-check: notes

  • Release All

    paperboytm/spool

    Publish the complete Spool CLI release train: synchronized versions, npm packages, the GitHub release, and the matching production web deployment.

    592 GitHub stars~1.1k tokensUpdated 2 mo ago
    DevOps & CloudAuto-check passed

  • Deploy

    noskillish/bankmcp

    Deploy BankMCP™ to a small server so it works in claude.ai and on the phone: Railway or Fly.io, volume, domain, setup page, connector.

    276 GitHub stars~744 tokensUpdated 10 days ago
    DevOps & CloudAuto-check passed

  • Hcls Deploy Agent

    aws-samples/amazon-bedrock-agents-healthcare-lifesciences

    Official

    A skill your agent uses when a developer wants to deploy an HCLS agent to Amazon Bedrock AgentCore, configure Gateway tools as MCP endpoints, set up authentication with Cognito, configure memory, or…

    274 GitHub stars~813 tokensUpdated 7 days ago
    DevOps & CloudAuto-check passed

More from openclaw/clawhub

All 56 skills in this repo

  • Axiom Alerting Management

    openclaw/clawhub

    Creates and manages Axiom monitors and notifiers end to end through the v2 API, with scripts for each CRUD operation and a recommended create-validate-tune workflow.

    9.5k GitHub stars~2.1k tokensUpdated yesterday
    Auto-check passed

  • Axiom Dashboard Builder

    openclaw/clawhub

    Designs and deploys Axiom dashboards through the API, choosing chart types and writing APL or metrics queries, with templates and migration notes for Splunk and Grafana.

    9.5k GitHub stars~4.9k tokensUpdated yesterday
    Auto-check passed

  • Axiom Cost Control

    openclaw/clawhub

    Finds unused data in Axiom by analyzing query patterns, then deploys a cost dashboard and ingest monitors to keep spend under the contract limit.

    9.5k GitHub stars~1.7k tokensUpdated yesterday
    Auto-check passed

  • Axiom Metrics Query

    openclaw/clawhub

    Explores and queries OpenTelemetry metrics in Axiom MetricsDB, listing datasets, metrics and tags first and picking the right aggregation for each metric's type.

    9.5k GitHub stars~2.6k tokensUpdated yesterday
    Auto-check passed

  • Axiom SRE Investigator

    openclaw/clawhub

    Investigates incidents and production problems with hypothesis-driven debugging, queries Axiom observability data when available, and keeps secrets out of commands and output.

    9.5k GitHub stars~7.1k tokensUpdated yesterday
    Auto-check passed

  • Axiom Eval Writer

    openclaw/clawhub

    Scaffolds evaluation suites for the Axiom AI SDK: eval files, scorers, flag schemas and axiom.config.ts, generated from plain descriptions of an AI capability.

    9.5k GitHub stars~4.1k tokensUpdated yesterday
    Auto-check: warnings

Works with

Categories

Questions about Convex Deploy Guard

What does Convex Deploy Guard do?

Classify + announce the target Convex deployment before any deployment-affecting command; fresh explicit consent for prod actions; session read-only mode. Convex Deploy Guard is an agent skill from openclaw/clawhub. Classify + announce the target Convex deployment before any deployment-affecting command; fresh explicit consent for prod actions; session read-only mode.

When should I use Convex Deploy Guard?

Convex Deploy Guard fits situations like: tasks that involve Deployment.

How do I install Convex Deploy Guard in Claude Code?

Run `npx skills add openclaw/clawhub --skill convex-deploy-guard -a claude-code`. Or copy the skill folder (.agents/skills/convex-deploy-guard in openclaw/clawhub) into .claude/skills/convex-deploy-guard in your project. Claude Code loads it when a task matches its description.

How do I install Convex Deploy Guard in Codex?

Run `npx skills add openclaw/clawhub --skill convex-deploy-guard -a codex`. Or copy the skill folder (.agents/skills/convex-deploy-guard in openclaw/clawhub) into .agents/skills/convex-deploy-guard in your project. Codex loads it when a task matches its description.

Can I use Convex Deploy Guard in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add openclaw/clawhub --skill convex-deploy-guard -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/convex-deploy-guard, .gemini/skills/convex-deploy-guard, .github/skills/convex-deploy-guard and .opencode/skills/convex-deploy-guard in your project.

What does Convex Deploy Guard need to run?

Going by SKILL.md and its folder, Convex Deploy Guard needs the command-line tools its instructions call (npx) and credentials named CONVEX_DEPLOY_KEY. Our summary lists: Node.js; A credential in CONVEX_DEPLOY_KEY.

Does Convex Deploy Guard access the network?

SKILL.md contains no URLs. Its commands use npx, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Convex Deploy Guard safe to install?

Our automated static check of SKILL.md found notes only (mentions a .env file), nothing it rates as a warning. It is not a guarantee. Review the folder before installing.

What licence does Convex Deploy Guard use?

Convex Deploy Guard is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Convex Deploy Guard use?

About 885 tokens (SKILL.md is roughly 3.5k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Convex Deploy Guard?

Skills that share tags, products or a category with Convex Deploy Guard: AWS Cdk Development (zxkane/aws-skills, 367 stars), Prepare Cloudflare Production Deployment (LubomirGeorgiev/cloudflare-workers-nextjs-saas-template, 786 stars), Deploy Observability (aliyun/alibabacloud-observability-mcp-server, 166 stars) and Release All (paperboytm/spool, 592 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Convex Deploy Guard?

openclaw (a GitHub organization) maintains it in openclaw/clawhub, which has 9,495 GitHub stars. The repository holds 56 skills in this directory. The repository was last updated on October 7, 2026.

Source: openclaw/clawhub on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.