clerk-backend-api
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches API specification files from the official Clerk GitHub repository (github.com/clerk/openapi-specs). This is used to provide the AI agent with context about available API endpoints and their schemas.
- [COMMAND_EXECUTION]: Executes several local bash and Node.js scripts to parse downloaded specifications and interact with the API.
- scripts/api-specs-context.sh retrieves the list of available API versions.
- scripts/extract-tags.js, scripts/extract-tag-endpoints.sh, and scripts/extract-endpoint-detail.sh process YAML specifications to extract relevant documentation.
- scripts/execute-request.sh uses curl to perform authorized API calls.
- [REMOTE_CODE_EXECUTION]: The skill uses piping patterns (e.g., curl ... | bash scripts/...) that triggered automated scanners. Technical review confirms these are safe data-processing patterns: remote API specifications are piped into local scripts as data inputs for parsing, not executed as instructions.
- [CREDENTIALS_UNSAFE]: The skill manages the CLERK_SECRET_KEY by sourcing it from local .env files, which is an established and secure practice for CLI applications. The key is only sent to the official Clerk API endpoint (api.clerk.com) or a user-defined base URL.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external OpenAPI specifications which are presented to the AI agent.
- Ingestion points: Specification files downloaded from GitHub in SKILL.md.
- Boundary markers: Data is isolated and wrapped in markdown code blocks by the extraction scripts.
- Capability inventory: The skill can perform authenticated write and delete operations via execute-request.sh.
- Sanitization: Extraction scripts use structured parsing to retrieve specific keys (tags, paths, summaries) from the YAML data.
Audit Metadata