clerk-nextjs-skills

This is a legitimate MCP authentication and tool-integration guide, not apparent malware. The primary security concerns are unsafe handling in the illustrative custom tools: caller-controlled filenames can cause path traversal in some storage implementations, unrestricted base64 uploads can consume resources, and free-form database queries may enable injection depending on the database layer. The authentication and public OAuth metadata design is expected for MCP, but production deployments should enforce scopes, validate tool inputs, minimize returned user data, apply upload limits, and use a safe database query interface.