clerk-enterprise-rbac
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements surfaces for processing external data which could be targeted by indirect prompt injection.
- Ingestion points: API route examples in
SKILL.mdandreferences/implementation-guide.mdingest external data viareq.json()and SAML metadata XML. - Boundary markers: The implementation utilizes Clerk's
auth()andhas()permission checks as security boundaries. - Capability inventory: The skill includes code for creating organization invitations, updating memberships, and managing roles via the Clerk Backend API.
- Sanitization: The examples rely on the Clerk SDK and server-side validation for input sanitization.
Audit Metadata