Skip to content
skillsafebeta
← Report library
Purpose / Other

Clerk Setup Skill Security Audit

What the author says it does (original text)

Add Clerk authentication to any project by following the official quickstart

Independent security check

Do not install or run it yet

Files checked
2
Risks found
5
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

The agent is told to execute complete setup instructions extracted from a mutable webpage

Source references: 3
What we found

The Skill extracts all code and configuration steps from an external quickstart and then directs the agent to execute them, including package installation and authentication-file changes. Although the stated URL is Clerk’s site, its content can change, and the Skill neither pins a version nor requires review of the resulting commands.

Why this matters

An incorrect update, compromised dependency, or instructions unsuitable for the project could install unwanted software or alter authentication boundaries, causing build failures or access-control errors.

The Skill actively requests “complete” instructions from a Clerk webpage and then directs the agent to execute them, including package installation, environment variables, and authentication middleware changes. The URL is official and the behavior fits the setup purpose, but the page is mutable and these lines require no pre-execution review. The user can restrict the agent to showing the source, commands, and diffs for approval first.

SKILL.md:141In the instructionsOpen original file
Use WebFetch to retrieve the official quickstart for the detected framework:```WebFetch: https://clerk.com/docs/{framework}/getting-started/quickstartPrompt: "Extract the complete setup instructions including all code snippets, file paths, and configuration steps."```
Show 2 other places
SKILL.md:150In the instructionsOpen original file
Execute each step from the quickstart guide:- Install the required packages- Set up environment variables- Add the provider and proxy/middleware- Create sign-in/sign-up routes if needed- Test the integration
SKILL.md:148In the instructionsOpen original file
### 3. Follow the InstructionsExecute each step from the quickstart guide:- Install the required packages- Set up environment variables- Add the provider and proxy/middleware- Create sign-in/sign-up routes if needed- Test the integration
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Production keys can be pulled directly into an automatically selected local environment file

Source references: 2
What we found

Daily operations explicitly include clerk env pull --instance prod, while framework detection automatically chooses the variable names and destination environment file. This section does not require confirmation of the exact file, its permissions, or version-control exclusions before writing.

Why this matters

If the selected file is committed, backed up, synchronized, or readable by other local users, the production secret key may be disclosed. Pulling it into the wrong project also broadens credential exposure.

Daily operations explicitly include pulling production keys, while another instruction says the CLI automatically chooses the variable names and an .env-style target file. This may be legitimate for deployment, but it writes sensitive production credentials locally without requiring confirmation of the destination, permissions, or version-control exclusions in the cited text. The user can require explicit approval and display of the target path and ignore rules before any production pull.

SKILL.md:55In the instructionsOpen original file
```bashclerk env pull                        # refresh keys (uses linked profile)clerk env pull --instance prod        # production keysclerk doctor --json                   # framework integration health check```
Show 1 other places
SKILL.md:77In the instructionsOpen original file
- Pass `--json` on `apps list/create`, `users create`, and `doctor` for parseable output.- The CLI auto-detects framework env var names (`VITE_CLERK_PUBLISHABLE_KEY` for Vite, `NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY` for Next.js, etc.) and target file (`.env.development.local` > `.env.local` > `.env`).
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 1
Medium risk

One auto-confirmed command installs dependencies, rewrites the project, and creates an external Clerk app

Source references: 2
What we found

The new-project flow uses clerk init with -y. The documentation says this installs the SDK, wires the project, writes keys, and creates a claimable external app when unauthenticated, combining several changes in one non-interactive command.

Why this matters

If the wrong directory is selected, framework detection is wrong, or the user only wanted guidance, this can introduce unwanted dependencies and code/environment-file changes and leave an unplanned Clerk resource. Keys written to an environment file also become local credentials that must be protected.

This is an active new-project command using `-y` for automatic confirmation. The text says it installs the SDK, modifies the project, writes publishable and secret keys, and, when unauthenticated, provisions a claimable accountless app. That matches the stated Clerk setup purpose, but combines local and external state changes. The user can require confirmation of the project path, affected files, and permission to create the external app.

SKILL.md:25In the instructionsOpen original file
```bashclerk init --framework <next|react|vue|nuxt|astro|react-router|tanstack-react-start|expressjs|fastify|expo> -y```
Show 1 other places
SKILL.md:29In the instructionsOpen original file
`clerk init` installs the SDK, wires the project up, and writes the framework-specific publishable + secret keys to the right env file (e.g. `.env.local` for Next.js, `.env` for Vite-based projects).**No login required.** On a supported framework, unauthenticated `clerk init` provisions a claimable accountless app and writes temporary development keys to the project's env file — no account, no browser, no flag. Don't run `clerk auth login` first. Authenticated (or with `--app` / `--login`) it creates and links a real app via PLAPI instead.
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 2
High risk

A raw API command can rotate an app secret and invalidate the old key after 24 hours

Source references: 3
What we found

The Skill provides a direct platform API call that rotates secret keys and retains old keys for only 24 hours. It does not require confirmation beside the command that the target is a development versus production app or verification that every deployment has received the new key.

Why this matters

If run against the wrong app, or if the new key is not deployed to every service in time, server-side Clerk calls and authentication flows may fail after expiration, interrupting production sign-in or protected features.

This is an active API command that directly changes a Clerk application's credentials, not merely a warning. Its parameter causes old keys to expire after a 24-hour grace period; choosing the wrong app or failing to update deployments could cause an outage. Rotation is legitimate security maintenance, but these lines do not require verification of the environment or rollout state. The user can require explicit confirmation of the app, environment, and deployment readiness.

SKILL.md:63In the instructionsOpen original file
PLAPI exposes secret-key rotation directly. Use raw `clerk api` until the friendly wrapper ships:```bashclerk api --platform POST /v1/platform/applications/<app_id>/rotate_secret_keys \  -d '{"delay_old_secrets_expiration_hours": 24, "reason": "scheduled rotation"}'```
Show 2 other places
SKILL.md:70In the instructionsOpen original file
`delay_old_secrets_expiration_hours` keeps the old key valid for the grace period so deploys can roll forward without downtime.
SKILL.md:61In the instructionsOpen original file
### Rotate the secret key (replaces Dashboard rotation)PLAPI exposes secret-key rotation directly. Use raw `clerk api` until the friendly wrapper ships:```bashclerk api --platform POST /v1/platform/applications/<app_id>/rotate_secret_keys \  -d '{"delay_old_secrets_expiration_hours": 24, "reason": "scheduled rotation"}'```
Low risk

The install command does not pin a dependency version

Source references: 4
What we found

The installation command does not specify dependency versions. The same command may download different code later, so what you install can differ from what was checked.

Why this matters

A later install may download different code even though the command and this report have not changed.

This is an active installation command, not a warning or negated example, and it does not specify an @clerk/ui version. Execution therefore resolves whatever version is current at that time. This is consistent with adding Clerk themes, but the user can require an audited pinned version and a committed lockfile.

The shadcn theme step also installs @clerk/ui without pinning a version. It is a legitimate conditional operation when the project uses shadcn/ui, but a future run may obtain code different from what was reviewed. The user can require a pinned version and review the lockfile diff first.

SKILL.md:266In the instructionsOpen original file
```bashnpm install @clerk/ui```
Show 3 other places
SKILL.md:263In the instructionsOpen original file
Themes are installed from `@clerk/ui`:```bashnpm install @clerk/ui```
SKILL.md:276In the instructionsOpen original file
```bashnpm install @clerk/ui```
SKILL.md:273In the instructionsOpen original file
If the project uses shadcn/ui (check for `components.json` in the project root), apply the shadcn theme so Clerk components match the app's design system:```bashnpm install @clerk/ui```
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

The Skill identifies the framework from package.json, fetches the corresponding Clerk quickstart, and directs the agent to perform package installation, environment-variable, authentication middleware, and testing steps.

View source
SKILL.md:137In the instructionsOpen original file
Read the project's `package.json` and match dependencies to the table above.
SKILL.md:141In the instructionsOpen original file
Use WebFetch to retrieve the official quickstart for the detected framework:```WebFetch: https://clerk.com/docs/{framework}/getting-started/quickstartPrompt: "Extract the complete setup instructions including all code snippets, file paths, and configuration steps."```
SKILL.md:150In the instructionsOpen original file
Execute each step from the quickstart guide:- Install the required packages- Set up environment variables- Add the provider and proxy/middleware- Create sign-in/sign-up routes if needed- Test the integration

For a new project, the preferred flow is a single clerk init command that reportedly installs the SDK, modifies the integration, and—when unauthenticated—creates a claimable external Clerk app with temporary keys.

View source
SKILL.md:25In the instructionsOpen original file
```bashclerk init --framework <next|react|vue|nuxt|astro|react-router|tanstack-react-start|expressjs|fastify|expo> -y```
SKILL.md:29In the instructionsOpen original file
`clerk init` installs the SDK, wires the project up, and writes the framework-specific publishable + secret keys to the right env file (e.g. `.env.local` for Next.js, `.env` for Vite-based projects).**No login required.** On a supported framework, unauthenticated `clerk init` provisions a claimable accountless app and writes temporary development keys to the project's env file — no account, no browser, no flag. Don't run `clerk auth login` first. Authenticated (or with `--app` / `--login`) it creates and links a real app via PLAPI instead.

For existing applications, the Skill provides commands to log in through OAuth, create or link Clerk apps, and pull development or production keys; when no app ID is known, it tells the agent to ask the user instead of guessing.

View source
SKILL.md:37In the instructionsOpen original file
```bashclerk auth login                      # one-time OAuth (skip if already logged in)clerk link                            # autolinks if a CLERK_PUBLISHABLE_KEY is in your .envclerk link --app app_xxx              # explicit form, required in agent modeclerk env pull                        # writes the framework-detected env vars```
SKILL.md:46In the instructionsOpen original file
```bashclerk auth loginclerk apps create "My App" --json     # returns the new app_idclerk link --app app_xxxclerk env pull```
SKILL.md:75In the instructionsOpen original file
- Unclaimed accountless apps created by `clerk init` are configurable without an account — see the [accountless command table](../clerk-cli/references/auth.md#accountless-operating-without-an-account) for which commands work and which need a claimed app.- `clerk link` (no flags) only autolinks when a `CLERK_PUBLISHABLE_KEY` is already in `.env` / `.env.local`. Without it, agent mode errors out: "Cannot select an application in agent mode." When that happens, run `clerk apps list --json`, and ask the user which `app_id` to link rather than guessing.- Pass `--json` on `apps list/create`, `users create`, and `doctor` for parseable output.

The migration section calls for an audit and migration plan first, explicitly notes that switching terminates existing sessions, and discusses exporting users for import through Clerk's Backend API.

View source
SKILL.md:178In the instructionsOpen original file
If the project already has authentication, create a migration plan before replacing it.
SKILL.md:200In the instructionsOpen original file
2. **Create migration plan** - Consider:   - **User data export** - Export users and import via Clerk's Backend API   - **Password hashes** - Clerk can upgrade hashes to Bcrypt transparently   - **External IDs** - Store legacy user IDs as `external_id` in Clerk   - **Session handling** - Existing sessions will terminate on switch
Start here · InstructionsSKILL.md
clerk-setup
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 2 more sections are available in the original file.
Files and check records2 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • evals/evals.jsonFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • evals/evals.jsonSupporting file

Operations mentioned in code and instructions

Run commands
SKILL.md:25In the instructionsOpen original file
```bashclerk init --framework <next|react|vue|nuxt|astro|react-router|tanstack-react-start|expressjs|fastify|expo> -y
SKILL.md:37In the instructionsOpen original file
```bashclerk auth login                      # one-time OAuth (skip if already logged in)
SKILL.md:46In the instructionsOpen original file
```bashclerk auth login
Read keys or account settings
SKILL.md:29In the instructionsOpen original file
`clerk init` installs the SDK, wires the project up, and writes the framework-specific publishable + secret keys to the right env file (e.g. `.env.local` for Next.js, `.env` for Vite-based projects).
SKILL.md:39In the instructionsOpen original file
clerk auth login                      # one-time OAuth (skip if already logged in)clerk link                            # autolinks if a CLERK_PUBLISHABLE_KEY is in your .envclerk link --app app_xxx              # explicit form, required in agent mode
SKILL.md:75In the instructionsOpen original file
- Unclaimed accountless apps created by `clerk init` are configurable without an account — see the [accountless command table](../clerk-cli/references/auth.md#accountless-operating-without-an-account) for which commands work and which need  …- `clerk link` (no flags) only autolinks when a `CLERK_PUBLISHABLE_KEY` is already in `.env` / `.env.local`. Without it, agent mode errors out: "Cannot select an application in agent mode." When that happens, run `clerk apps list --json`, and ask the user which `app_id` to link rather than guessing.- Pass `--json` on `apps list/create`, `users create`, and `doctor` for parseable output.
Connect to websites
SKILL.md:88In the instructionsOpen original file
| 3. Follow instructions | Execute steps; create `proxy.ts` (Next.js <=15: `middleware.ts`) || 4. Get API keys | From [dashboard.clerk.com](https://dashboard.clerk.com/~/api-keys) |
SKILL.md:98In the instructionsOpen original file
|------------|-----------|----------------|| `next` | Next.js | `https://clerk.com/docs/nextjs/getting-started/quickstart` || `@remix-run/react` | Remix (deprecated) | Migrate to React Router v7 — use the React Router quickstart below |
SKILL.md:100In the instructionsOpen original file
| `@remix-run/react` | Remix (deprecated) | Migrate to React Router v7 — use the React Router quickstart below || `react-router` | React Router (v7+) | `https://clerk.com/docs/react-router/getting-started/quickstart` || `astro` | Astro | `https://clerk.com/docs/astro/getting-started/quickstart` |
Install extra software packages
SKILL.md:266In the instructionsOpen original file
```bashnpm install @clerk/ui```
SKILL.md:276In the instructionsOpen original file
```bashnpm install @clerk/ui```
Lines read
407
File checksum (to compare versions)
adde66a7c0a963a1e652ec060e4a607d5bf071b2649833508a70fd16022d447a