api-auth-clerk
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a security-first approach to authentication, explicitly teaching users how to avoid common pitfalls like middleware bypass and credential leakage.
- [SAFE]: Webhook handling instructions (Pattern 6 in SKILL.md and Pattern 5 in server.md) correctly mandate the use of signature verification to prevent unauthorized data injection.
- [SAFE]: Documentation provides clear warnings against passing the full
currentUser()object to client components, which protects sensitiveprivateMetadatafrom being exposed to the browser. - [SAFE]: Environment variable examples use non-functional placeholders (e.g.,
pk_test_abc123) and reinforce the requirement to never hardcode secret keys in source code. - [SAFE]: Middleware patterns (Pattern 1) use an explicit whitelist approach for public routes, ensuring all other application paths are protected by default.
Audit Metadata