verify-clerk-expo
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a custom CLI tool (
control-clerk-expo) to orchestrate development and testing workflows, including mobile app builds (xcodebuild,gradlew), dependency management (pnpm,npm), and device control. These operations are essential for its purpose as a mobile E2E test harness. - [EXTERNAL_DOWNLOADS]: Interacts with official package registries and GitHub Actions to provision remote testing environments and build artifacts. All external interactions are directed at well-known, trusted services (GitHub, Google, Clerk) necessary for the skill's primary function.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-visible UI text from mobile applications during testing. While this is an ingestion surface, the framework is designed for controlled testing environments using seeded test data, and it mandates manual review of video and screenshots for all verification evidence.
- [SAFE]: The skill implements a 'taint analysis' post-execution step that scans for and redacts sensitive tokens (JWTs, API keys, passwords) from generated logs and reports. It also explicitly instructs users to avoid hardcoding credentials and provides methods for secure secret management via environment variables or encrypted stores.
Audit Metadata