clerk-debug-bundle
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_CONTEXT_INJECTION
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The skill utilizes load-time shell commands (
!node --versionand!npm list) to automatically display runtime environment information when the skill is initialized. - [INDIRECT_PROMPT_INJECTION]: The skill identifies and processes application-level data to generate diagnostic reports, representing a potential injection surface.
- Ingestion points: Request metadata such as
pathnameandmethodprocessed inmiddleware.ts, and project metadata frompackage.jsonread inclerk-debug.ts. - Boundary markers: No specific boundary markers or 'ignore' instructions are present in the generated log formats.
- Capability inventory: Includes file system reading (
Read), console logging for diagnostics, and local API requests for health checks. - Sanitization: The skill follows security best practices by truncating Publishable Keys (e.g.,
slice(0, 8)) and only checking for the presence of Secret Keys rather than logging them.
Audit Metadata