authentication-authorization-clerk
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documentation includes patterns for ingesting external data via Clerk webhooks and API request bodies, which represent a potential attack surface for indirect injection.
- Ingestion points: Webhook receiver (
app/api/webhooks/clerk/route.ts) and protected API routes (app/api/premium/generate/route.ts). - Boundary markers: Uses
clerkMiddlewarefor global route isolation andauth()for per-request identity verification. - Capability inventory: Demonstrates database management (user creation, updates, and deletions) and execution of premium business logic.
- Sanitization: Explicitly demonstrates and requires signature verification via the
svixlibrary for all incoming webhooks and schema-based validation for API payloads. - [SAFE]: The skill promotes a high-security posture by instructing the use of managed authentication services, which mitigates risks associated with custom implementations such as weak hashing or insecure session management. All external references to Clerk and Svix target well-known, trusted service providers.
Audit Metadata