v0.1.0

Clerk Auth

ReviewClawScan verdict for this skill. Analyzed May 1, 2026, 4:57 AM.

Analysis

The Clerk guidance is mostly purpose-aligned, but its companion setup agent can read and print local Clerk secrets and run/write setup commands, so it needs review before use.

GuidanceReview this skill before installing. It is useful for Clerk authentication setup, but run it only on a branch or disposable workspace, do not allow it to print secret values from `.env` files, and approve all Bash/file edits manually. Pin package versions and back up env files before using the setup agent.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityMediumConfidenceHighStatusConcern

agents/clerk-setup.md

description: Clerk authentication setup specialist. MUST BE USED when configuring Clerk, setting up webhooks, or troubleshooting auth issues. Use PROACTIVELY for new auth implementations.
tools: Read, Write, Edit, Bash, Grep, Glob, WebFetch

The companion agent is instructed to run proactively and has broad file-editing and shell authority. That authority is relevant to setup, but the artifacts do not clearly require user approval, diffs, backups, or command-by-command confirmation before modifying a project.

User impactThe agent may make project changes, install packages, or run setup commands while configuring Clerk, which could alter your app or environment if not reviewed.

RecommendationUse the agent only on a clean branch, require explicit approval before Bash/Write/Edit operations, and review generated diffs before applying changes.

Tool Misuse and Exploitation

SeverityMediumConfidenceHighStatusConcern

agents/clerk-setup.md

cat > .env.local << 'EOF'
CLERK_PUBLISHABLE_KEY=pk_test_...
CLERK_SECRET_KEY=sk_test_...
EOF

The setup workflow demonstrates overwriting `.env.local` with placeholder Clerk values. In an automated setup workflow, this could clobber existing environment configuration or replace real settings without a backup.

User impactExisting local environment settings could be overwritten, breaking the app or replacing valid secrets with placeholders.

RecommendationChange this workflow to append only missing variables, preserve existing files, create backups, and ask the user before writing any env file.

Agentic Supply Chain Vulnerabilities

SeverityLowConfidenceHighStatusNote

references/common-errors.md

npm install @clerk/nextjs@latest
npm install @clerk/backend@latest
npm install @clerk/clerk-react@latest

Installing Clerk packages is expected for this skill, but using `@latest` means the installed code can change over time and may not match the documented tested versions.

User impactYou may install newer package versions with different behavior than the guide expects.

RecommendationPin package versions in production projects and test upgrades deliberately.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityHighConfidenceHighStatusConcern

agents/clerk-setup.md

grep -r "CLERK" .env* 2>/dev/null || echo "No .env files found"
...
grep CLERK .env* .dev.vars 2>/dev/null

These commands inspect local environment files and can print Clerk secret keys or webhook secrets into the agent/session output. Clerk secret keys can authorize Backend API actions, so unredacted reading/output is high-impact credential handling.

User impactYour Clerk secret key or webhook secret could be exposed in the conversation or logs while the agent is only trying to check setup.

RecommendationRequire confirmation before reading env files, redact values by default, and check only variable presence, for example by printing `CLERK_SECRET_KEY=set` rather than the actual value.