p-eng-clerk-auth
Warn
Audited by Snyk on Apr 16, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.80). The skill's ClerkJwtStrategy explicitly fetches JWKS from the Clerk issuer (jwksUri
${issuer}/.well-known/jwks.json) and may call the public Clerk API to enrich user data (fetch tohttps://api.clerk.com/v1/users/${clerkUserId}) as part of authentication/sync-on-demand, meaning it ingests untrusted third-party/user-provided content that directly affects authentication/authorization decisions.
Issues (1)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata