clerk-ci-integration
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides legitimate documentation and code templates for DevOps and testing workflows. It uses standard practices for secret management by instructing the user to configure GitHub Secrets rather than hardcoding credentials.
- [EXTERNAL_DOWNLOADS]: The skill references the installation of necessary testing tools from well-known providers.
npx playwright install --with-deps: Downloads Playwright browser binaries and dependencies from official sources during CI execution.- [INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface through the use of external environment variables in testing scripts.
- Ingestion points: Environment variables such as
CLERK_TEST_USER_EMAILandCLERK_TEST_USER_PASSWORDare ingested viaprocess.envin files likee2e/auth.setup.tsandscripts/seed-ci-user.ts. - Boundary markers: None present (standard for configuration-based data ingestion).
- Capability inventory: The provided code snippets include capabilities for writing to the file system (Playwright auth state JSON) and performing network requests (Clerk API interaction).
- Sanitization: No explicit sanitization or validation of environment variables is implemented, which is typical for internal testing infrastructure.
Audit Metadata