clerk-deploy-integration

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill provides standard documentation and boilerplate for deploying Clerk applications.
  • Environment variable examples use clearly marked placeholders like pk_live_... and sk_live_... instead of hardcoded secrets.
  • Deployment instructions leverage official platform CLI tools (vercel, netlify, railway) and multi-stage Docker builds to ensure secure secret handling.
  • External links point to official Clerk documentation and trusted platform domains.
  • [INDIRECT_PROMPT_INJECTION]: The provided verification script scripts/verify-deployment.sh contains a surface for indirect instructions through external URLs.
  • Ingestion points: The DOMAIN variable in the bash script accepts external URLs.
  • Boundary markers: Absent.
  • Capability inventory: The generated script utilizes curl for network requests and python3 for JSON processing.
  • Sanitization: Absent.
  • Risk evaluation: The risk is assessed as minimal because the script is intended for user-controlled verification and the agent's own tool execution is restricted to specific platform CLIs by the allowed-tools configuration.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 03:42 AM