Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

Manage env vars + secrets · get-convex | DecimalAI

get-convex/convex-env

NewSkillScoreMaintained

Set and wire Convex deployment env vars / secrets for the app.

DevOpsby get-convex

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

DevOps & SRE pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/get-convex-convex-env/SKILL.md

decimalai skills pull get-convex-convex-env --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/get-convex-convex-env/SKILL.md https://app.decimal.ai/s/get-convex-convex-env/SKILL.md

Raw file: /s/get-convex-convex-env/SKILL.md ↗ · machine-readable summary at /s/get-convex-convex-env.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

25 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 25h ago

Yes — +24% lift-34% tokens0% turns84% of whole cases pass with skill (21/25)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-01	✗→✓	▲ Improved	-52%	0%
case-04	✗→✓	▲ Improved	-13%	0%
case-12	✗→✓	▲ Improved	-59%	0%
case-15	✗→✓	▲ Improved	-13%	0%
case-19	✗→✓	▲ Improved	-38%	0%

Showing 5 of 25 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/7/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

get-convex / agent-skills

skills/convex-env/SKILL.md

View on GitHub ↗

Imported 8/7/2026Version v1

Skill contents

SKILL.md

Manage env vars + secrets

Store secrets as Convex deployment env vars (npx convex env set), read them with process.env in actions, never commit them.

Workflow

npx convex env set KEY value (per deployment).
Read via process.env.KEY inside actions (not queries/mutations).
Never hardcode or commit secrets; add to .env.local only for local.
Confirm with npx convex env list.

Rules

Secrets live in Convex env vars, never in code or git.
process.env only in actions ('use node' if needed), not queries/mutations.
Different deployments need their own values.

Want to see if get-convex/convex-env would activate on your phrasing? Try it before you install — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/28/2026, 10:27 UTC · 25 cases

Lift

+24%

84% vs 60%

Agent turns

0%

1.0 vs 1.0

Tokens

-34%

1,191.84 vs 1,814.44

fail → pass · 6pass → pass · 15fail → fail · 4

Per-case results (25)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-01 What is the proper way to store environment variables across different Convex deployments, and what rules dictate which backend function types can access those environment variables at runtime?	fail→pass	16,272	16,911	+4%	1	1	0%	2,724	1,320	-52%	0	0	—
case-02 I am integrating Stripe into my Convex project and need to supply `STRIPE_SECRET_KEY` to my backend logic. Should I place this secret in my Convex code or config file so mutations can read it directly? Explain the CLI command to register it and where in the code it can be read.	pass→pass	9,654	5,984	-38%	1	1	0%	1,664	1,199	-28%	0	0	—
case-03 We have a Convex `query` function that checks `process.env.FEATURE_FLAG_KEY` to conditionally return data to users. Is reading `process.env` directly within a Convex query standard practice, or how should environment variables be handled in query logic?	fail→fail	14,461	13,706	-5%	1	1	0%	2,445	2,115	-13%	0	0	—
case-04 In a Convex `mutation` function responsible for signing up a user, I want to read `process.env.SENDGRID_KEY` to verify the mailer credentials before performing database writes. Explain whether reading `process.env` in a mutation is allowed and how to structure this correctly.	fail→pass	15,980	12,555	-21%	1	1	0%	2,375	2,061	-13%	0	0	—
case-05 When working on Convex functions locally on a developer workstation, where should sensitive API keys be placed so they do not get checked into source control?	pass→pass	9,945	4,554	-54%	1	1	0%	1,667	907	-46%	0	0	—
case-16 If I add `'use node'` to the top of a Convex mutation file, will that enable reading `process.env` secrets inside that mutation?	fail→fail	10,880	8,349	-23%	1	1	0%	1,564	1,547	-1%	0	0	—
case-06 I just deployed a project to Convex and want to inspect all environment variables currently configured on the remote deployment from my terminal. Which command should I run?	pass→pass	5,479	2,619	-52%	1	1	0%	882	479	-46%	0	0	—
case-07 My Convex action needs to call an external payment API using process.env secrets and requires Node.js runtime features. What directive or configuration is needed in the file to run under Node?	pass→pass	7,324	3,698	-50%	1	1	0%	1,251	720	-42%	0	0	—
case-08 If I run `npx convex env set API_KEY 123` while connected to my development deployment, will my production deployment automatically inherit this key value?	pass→pass	4,230	2,871	-32%	1	1	0%	731	597	-18%	0	0	—
case-09 To ensure our Convex functions do not throw runtime errors if an environment variable is missing, a developer proposed writing `const secret = process.env.MY_SECRET \|\| 'fallback_key_123'` directly in backend code. Evaluate this approach.	pass→pass	13,698	8,543	-38%	1	1	0%	2,182	1,561	-28%	0	0	—
case-10 We need to send a Slack alert using `process.env.SLACK_WEBHOOK_URL` whenever a user submits a support ticket in our Convex app. Should this logic be implemented inside a Convex mutation or a Convex action?	fail→fail	13,888	6,705	-52%	1	1	0%	1,939	1,418	-27%	0	0	—
case-11 Our team changed our OpenAI API key. What exact terminal command updates the `OPENAI_API_KEY` variable on our remote Convex backend deployment?	pass→pass	4,883	2,661	-46%	1	1	0%	817	577	-29%	0	0	—
case-12 If I create a helper function in a shared utility file `utils.ts` that reads `process.env.SHARED_SECRET`, can I import and invoke this utility inside a Convex query?	fail→pass	13,585	6,159	-55%	1	1	0%	2,276	932	-59%	0	0	—
case-13 A developer wants to add `.env.local` containing test API keys to git source control so team members do not have to create their own. Is this compliant with security practices for Convex development?	pass→pass	12,424	5,264	-58%	1	1	0%	1,700	817	-52%	0	0	—
case-14 How are separate third-party API keys (such as staging vs production Stripe keys) managed between preview deployments and production in a Convex project?	pass→pass	17,901	10,520	-41%	1	1	0%	2,484	1,675	-33%	0	0	—
case-15 We are receiving incoming webhooks and need to verify the HMAC signature against `process.env.WEBHOOK_SECRET`. Where in the Convex backend architecture should this signature verification occur?	fail→pass	16,063	12,310	-23%	1	1	0%	2,364	2,053	-13%	0	0	—
case-17 When deploying our Convex application in a CI/CD pipeline, how should remote environment variables like `DATABASE_URL` or `AUTH_SECRET` be managed for the target deployment?	pass→pass	14,425	9,172	-36%	1	1	0%	2,350	1,714	-27%	0	0	—
case-18 What Convex CLI command allows a developer to verify which environment variables are currently set on their active deployment without printing sensitive values to stdout?	pass→pass	11,109	2,224	-80%	1	1	0%	1,817	436	-76%	0	0	—
case-19 A new engineer on our team assumes `process.env` works identically across queries, mutations, and actions in Convex. How should you correct their understanding of Convex runtime environments?	fail→pass	16,847	9,563	-43%	1	1	0%	2,809	1,745	-38%	0	0	—
case-20 An action fails because `process.env.THIRD_PARTY_KEY` is undefined in production. What step should be taken to supply this key safely without modifying backend source code?	fail→fail	10,333	2,718	-74%	1	1	0%	1,591	550	-65%	0	0	—
case-21 Which file should be used on a local machine to define environment variables for local Convex execution during development?	pass→pass	12,700	2,408	-81%	1	1	0%	1,983	494	-75%	0	0	—
case-22 We are initializing an S3 client SDK using `process.env.AWS_SECRET_ACCESS_KEY`. In which Convex backend file type should this SDK initialization and usage reside?	fail→pass	10,368	6,146	-41%	1	1	0%	1,463	1,207	-17%	0	0	—
case-23 How do I define a compound index on `authorId` and `creationTime` in my Convex database schema using `schema.ts`?	pass→pass	7,799	5,847	-25%	1	1	0%	1,430	1,254	-12%	0	0	—
case-24 How do I configure a scheduled cron job in Convex to execute a function every 5 minutes?	pass→pass	8,837	7,662	-13%	1	1	0%	1,576	1,276	-19%	0	0	—
case-25 How do I define an HTTP route handler in Convex using `httpRouter` to handle incoming GET requests at `/api/health`?	pass→pass	7,245	6,434	-11%	1	1	0%	1,277	1,142	-11%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 25 cases were attempted. The headline lift of +24 percentage points is the difference between those two pass rates over the 25 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 60%
Pass rate with the skill: 84%
Cases attempted: 25
Cases counted toward lift: 25
Cases that regressed: 0
Skill version measured: v1
Run completed: 8/28/2026, 10:27 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-01

Prompt

What is the proper way to store environment variables across different Convex deployments, and what rules dictate which backend function types can access those environment variables at runtime?

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signalsno signals yet

BenchmarkRun a verified benchmark with positive lift

Live evalNeeds ≥20 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

No signals yet — run a benchmark or collect evaluated traces to earn a score.

Verified on gemini-3.6-flash · re-tested yesterday

Other measured skills in the registry, with their headline benchmark lift.