Skip to content
skillsafebeta
← Report library
Purpose / Other

Clerk Skill Security Audit

What the author says it does (original text)

Clerk authentication router. Use when user asks about Clerk CLI operations,

Independent security check

Do not install or run it yet

Files checked
1
Risks found
3
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 3
High risk

High-privilege Clerk user impersonation is supported

Source references: 2
What we found

The router explicitly lists `clerk impersonate` as a CLI capability. Impersonation can let an operator inspect an application as the target user, while this router provides no environment restriction, target confirmation, or approval step.

Why this matters

If run against the wrong production instance, account, or unauthorized user, it could expose that user's accessible data and permissions and allow actions under their identity.

What this evidence establishes

The file does list user impersonation as a task handled by the Clerk CLI route, but it only delegates to an unavailable `clerk-cli` skill. It shows no command execution, target selection, or approval bypass. The evidence therefore does not establish impersonation of “any” user or uncontrolled high privilege; risk depends on the routed skill’s confirmation controls and the operator’s Clerk permissions. A user can request the `clerk-cli` source and restrict impersonation to test instances.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:43In the instructionsOpen original file
**Operating Clerk from the CLI** → Use `clerk-cli`- Auth, linking, `doctor`, and environment pulls- User, org, session, app, and instance management- Impersonating a user (`clerk impersonate`) and local webhook testing (`clerk webhooks listen`)- Feature toggles (`clerk enable orgs`, `clerk enable billing`)
Show 1 other places
SKILL.md:46In the instructionsOpen original file
- User, org, session, app, and instance management- Impersonating a user (`clerk impersonate`) and local webhook testing (`clerk webhooks listen`)- Feature toggles (`clerk enable orgs`, `clerk enable billing`)
Medium risk

Routing scope includes broad Clerk administration and configuration changes

Source references: 3
What we found

The CLI route covers users, organizations, sessions, applications, and instance management, plus enabling organizations or billing and calling Clerk APIs. Only API execution mentions scope enforcement; this router does not require previews or confirmation for specific mutations.

Why this matters

Writes against a production instance or wrong account could alter member access, sessions, application configuration, or billing capabilities, causing unauthorized access, lockouts, or unintended commercial configuration changes.

What this evidence establishes

The router covers management of several Clerk resource types, feature toggles, and API calls, so the delegated skills could perform account- or billing-affecting operations. However, this file contains no concrete commands or automatic-execution instruction, and it expressly describes API requests as scope-enforced. Because the `clerk-cli` and `clerk-backend-api` implementations are absent, whether previews, confirmations, or permission checks are missing cannot be determined. Users can request those skills for review and limit token scopes before use.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:43In the instructionsOpen original file
**Operating Clerk from the CLI** → Use `clerk-cli`- Auth, linking, `doctor`, and environment pulls- User, org, session, app, and instance management- Impersonating a user (`clerk impersonate`) and local webhook testing (`clerk webhooks listen`)- Feature toggles (`clerk enable orgs`, `clerk enable billing`)- Backend, Platform, and Frontend API calls through `clerk api`- Deploy handoff and deploy status verification
Show 2 other places
SKILL.md:137In the instructionsOpen original file
**Backend REST API** → Use `clerk-backend-api`- Browse API tags and endpoints- Inspect endpoint schemas- Execute API requests with scope enforcement
SKILL.md:45In the instructionsOpen original file
- Auth, linking, `doctor`, and environment pulls- User, org, session, app, and instance management- Impersonating a user (`clerk impersonate`) and local webhook testing (`clerk webhooks listen`)- Feature toggles (`clerk enable orgs`, `clerk enable billing`)- Backend, Platform, and Frontend API calls through `clerk api`- Deploy handoff and deploy status verification
Medium risk

Defaulting to the current SDK when detection is unclear can break older authentication integrations

Source references: 3
What we found

The file first calls for checking package.json but explicitly defaults to the current SDK when the version is unclear. It also says Core 2 and current releases use different package names and that custom-flow APIs differ entirely.

Why this matters

If version detection fails in an existing project, the agent may apply incompatible dependencies or authentication APIs, causing build failures, broken sign-in, or incorrectly protected routes.

This is an active routing rule: inspect `package.json`, but default to the current SDK when the version is unclear or the project is new. The file also states that Core 2 and current use different package names and that custom-flow APIs differ entirely. If version detection fails in an existing older project, subsequent guidance could select incompatible dependencies or APIs, breaking builds or authentication flows. Users can ask that existing projects stop for version confirmation instead of defaulting to current.

SKILL.md:20In the instructionsOpen original file
Check `package.json` to determine the Clerk SDK version. This determines which patterns to use:
Show 2 other places
SKILL.md:30In the instructionsOpen original file
**Default to current** if the version is unclear or the project is new. Core 2 packages use `@clerk/clerk-react` and `@clerk/clerk-expo` (with `clerk-` prefix); current packages use `@clerk/react` and `@clerk/expo`.All skills are written for the current SDK. When something differs in Core 2, it's noted inline with `> **Core 2 ONLY (skip if current SDK):**` callouts. The exception is `clerk-custom-ui`, which has separate `core-2/` and `core-3/` directories for custom flow hooks since those APIs are entirely different between versions.
SKILL.md:32In the instructionsOpen original file
All skills are written for the current SDK. When something differs in Core 2, it's noted inline with `> **Core 2 ONLY (skip if current SDK):**` callouts. The exception is `clerk-custom-ui`, which has separate `core-2/` and `core-3/` directories for custom flow hooks since those APIs are entirely different between versions.
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

3 instruction sections

This file is a router rather than an authentication implementation; it directs the agent to other Clerk skills based on the user's task.

View source
SKILL.md:38In the instructionsOpen original file
**Adding Clerk to your project** → Use `clerk-setup`- Framework detection and quickstart
SKILL.md:43In the instructionsOpen original file
**Operating Clerk from the CLI** → Use `clerk-cli`- Auth, linking, `doctor`, and environment pulls
SKILL.md:137In the instructionsOpen original file
**Backend REST API** → Use `clerk-backend-api`- Browse API tags and endpoints- Inspect endpoint schemas- Execute API requests with scope enforcement

The router instructs the agent to read the project's package.json to identify the Clerk SDK version and to default to current-version patterns when the version is unclear.

View source
SKILL.md:20In the instructionsOpen original file
Check `package.json` to determine the Clerk SDK version. This determines which patterns to use:
SKILL.md:30In the instructionsOpen original file
**Default to current** if the version is unclear or the project is new. Core 2 packages use `@clerk/clerk-react` and `@clerk/clerk-expo` (with `clerk-` prefix); current packages use `@clerk/react` and `@clerk/expo`.

Its declared scope includes authentication setup, user and organization management, billing, backend APIs, user impersonation, and deployment handoff, some of which can affect live accounts or access controls.

View source
SKILL.md:43In the instructionsOpen original file
**Operating Clerk from the CLI** → Use `clerk-cli`- Auth, linking, `doctor`, and environment pulls- User, org, session, app, and instance management- Impersonating a user (`clerk impersonate`) and local webhook testing (`clerk webhooks listen`)- Feature toggles (`clerk enable orgs`, `clerk enable billing`)- Backend, Platform, and Frontend API calls through `clerk api`- Deploy handoff and deploy status verification
SKILL.md:109In the instructionsOpen original file
**Billing & Subscriptions** → Use `clerk-billing`- `<PricingTable />` component- Plan and feature gating with `has()`- Seat-based B2B billing with organizations- Subscription lifecycle webhooks- Free trials, invoicing
Start here · InstructionsSKILL.md
clerk
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
Lines read
166
File checksum (to compare versions)
8f0387908110b1b8f6c78d1fbd7dce5c0538085d243a2b874726634e3d0378fa