clerk-cli
Pass
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the official Clerk CLI via standard package managers.
- Evidence: SKILL.md mentions
npx -y clerk@{{CLI_VERSION}},bunx clerk@{{CLI_VERSION}},pnpm dlx clerk@{{CLI_VERSION}}, andyarn dlx clerk@{{CLI_VERSION}}. - [COMMAND_EXECUTION]: The skill executes shell commands using the
clerkbinary. - Evidence: SKILL.md contains numerous examples of
clerkcommands likeclerk api,clerk users list, andclerk config pull. - [CREDENTIALS_UNSAFE]: The skill handles sensitive API keys but follows industry standards for management.
- Evidence: SKILL.md and references/auth.md recommend using
CLERK_SECRET_KEYandCLERK_PLATFORM_API_KEYenvironment variables or the system keychain instead of hardcoding values. - [DATA_EXFILTRATION]: The skill performs network operations to Clerk's official Backend and Platform APIs.
- Evidence: references/auth.md describes the use of
https://api.clerk.dev/v1/andhttps://api.clerk.com/v1/for operations. - [SAFE]: The skill provides robust safety mechanisms for agent-based execution and handles data ingestion surfaces safely.
- Evidence: SKILL.md and references/agent-mode.md document the use of
--dry-runto preview mutations, the requirement of--yesfor destructive calls in agent mode, and recommendations to save large API responses to local files for inspection withjqto avoid context flooding.
Audit Metadata