clerk-observability
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides patterns for processing external webhook data from Clerk, which constitutes a data ingestion surface. * Ingestion points: The file
app/api/webhooks/clerk/route.tshandlesWebhookEventdata received from external sources. * Boundary markers: The implementation guide demonstrates the use of Svix signature verification (wh.verify) to authenticate the source of the data. * Capability inventory: The provided code involves database interactions (db.user.create) and network transmission of log data. * Sanitization: Data integrity is managed through standard SDK-based verification methods. - [EXTERNAL_DOWNLOADS]: The implementation instructions include integration examples for DataDog, referencing its official intake endpoint at
https://http-intake.logs.datadoghq.com/v1/input. - [DATA_EXFILTRATION]: The skill facilitates the transmission of authentication event metadata, including user identifiers, to external monitoring platforms such as Sentry and DataDog. This is the primary intended function of the skill for production observability.
Audit Metadata