clerk-auth
Pass
Audited by Gen Agent Trust Hub on Nov 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a pattern for processing Clerk webhooks which represents a data ingestion surface. It explicitly mitigates this risk by requiring cryptographic signature verification via the Svix library and demonstrating structured field extraction rather than raw payload processing.\n- [EXTERNAL_DOWNLOADS]: References official documentation and integration resources from well-known services (Clerk and Svix). These links are provided for developer reference and do not involve unverified remote code execution.\n- [CREDENTIALS_UNSAFE]: The provided environment variable templates use standard placeholders (e.g., 'pk_test_...', 'sk_test_...') for demonstration and include clear instructions to keep secret keys server-side and out of client-accessible code.
Audit Metadata