The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill utilizes external documentation and source code from Clerk's official sites to guide the implementation process. This represents a potential surface for indirect prompt injection, although the sources are well-known and official.
Ingestion points: Implementation logic is derived from fetching content from https://clerk.com/docs/android/getting-started/quickstart and the clerk-android repository.
Boundary markers: The skill does not define specific delimiters to wrap or sanitize content retrieved via external tools.
Capability inventory: The agent is permitted to modify project files such as build.gradle, AndroidManifest.xml, and Kotlin source files.
Sanitization: Content from the external URLs is used as a reference for code generation without explicit filtering or validation steps.
[CREDENTIALS_UNSAFE]: The skill requires the user to provide a CLERK_PUBLISHABLE_KEY input and instructs the agent to embed this key directly within the application's initialization logic. This practice is standard for public-facing publishable keys in mobile environments and does not involve the exposure of private backend secrets.

clerk-android