clerk-backend-api
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads OpenAPI specifications from the official Clerk organization on GitHub. This targets a well-known and trusted service provider for authentication services.
- [COMMAND_EXECUTION]: Local Bash and Node.js scripts are used to parse downloaded data, and curl is used to interact with the API. These operations are transparent and consistent with the skill's stated purpose of exploring and executing API requests.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user input and API data. It effectively manages risks by enforcing mandatory boundary checks, such as verifying the presence of the secret key, checking API permission scopes, and requiring explicit human confirmation before executing any destructive or state-changing requests.
Audit Metadata