clerk-backend-api
Fail
Audited by Gen Agent Trust Hub on Nov 10, 2026
Risk Level: HIGHINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill fetches and processes external OpenAPI specifications from GitHub. While these are vendor-owned resources, processing network-retrieved content into the agent's context presents a potential surface for indirect prompt injection.
- Ingestion points: OpenAPI specs are fetched from GitHub in
scripts/api-specs-context.shandSKILL.md. - Boundary markers: No explicit delimiters are used to wrap the fetched content, though local parsing scripts serve as structural filters.
- Capability inventory: The skill possesses extensive shell execution capabilities via the
Bashtool and network access viaWebFetchandcurl. - Sanitization: Content is filtered through local extraction scripts (
extract-tags.js,extract-endpoint-detail.sh) before being displayed or used. - [EXTERNAL_DOWNLOADS]: The skill fetches configuration and API definitions from the vendor's official GitHub repository at
github.com/clerk/openapi-specs. This is standard functionality for retrieving the latest API schemas. - [COMMAND_EXECUTION]: The skill relies on shell commands to perform API requests using
curland to process data. It pipes downloaded YAML specifications into local scripts for parsing and extraction. - [CREDENTIALS_UNSAFE]: The skill requires a
CLERK_SECRET_KEYfor authentication. It includes a verification step that echoes the first 10 characters of the secret key to the console, which results in partial credential exposure in execution logs.
Recommendations
- HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/clerk/openapi-specs/main/bapi/${version_name} - DO NOT USE without thorough review
Audit Metadata