clerk-knowledge-patch

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes examples that hard-code API secrets (e.g., clerk.SetKey("sk_live_XXX") and bearer_auth="sk_live_xxx"), which instructs embedding secret values verbatim in code/requests and thus requires the LLM to handle/output secrets directly.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly documents Clerk's billing APIs and components for performing billing actions: CheckoutButton, useCheckout/PaymentElement, billing hooks, and backend/client billing APIs. The Quick Reference shows backend calls such as client.billing.getUserBillingSubscription(...) and await client.billing.cancelSubscriptionItem(...), which are concrete APIs that modify subscriptions/billing. It also shows use of secret keys (sk_live_xxx) in SDK examples, indicating server-side transactional authority. These are specific financial operations (managing payments/subscriptions), not generic tooling, so this meets the "Direct Financial Execution" criterion.