clerk-deploy-integration
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides standard documentation and boilerplate for deploying Clerk applications.
- Environment variable examples use clearly marked placeholders like
pk_live_...andsk_live_...instead of hardcoded secrets. - Deployment instructions leverage official platform CLI tools (
vercel,netlify,railway) and multi-stage Docker builds to ensure secure secret handling. - External links point to official Clerk documentation and trusted platform domains.
- [INDIRECT_PROMPT_INJECTION]: The provided verification script
scripts/verify-deployment.shcontains a surface for indirect instructions through external URLs. - Ingestion points: The
DOMAINvariable in the bash script accepts external URLs. - Boundary markers: Absent.
- Capability inventory: The generated script utilizes
curlfor network requests andpython3for JSON processing. - Sanitization: Absent.
- Risk evaluation: The risk is assessed as minimal because the script is intended for user-controlled verification and the agent's own tool execution is restricted to specific platform CLIs by the
allowed-toolsconfiguration.
Audit Metadata