clerk-swift
Fail
Audited by Snyk on Mar 2, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 1.00). The skill explicitly requires asking the developer for a Clerk publishable key and to "wire the developer-provided publishable key plainly in app configuration passed to Clerk.configure," which forces the agent to accept and emit the key verbatim in generated code/config.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.90). The skill mandates visiting and reading the Clerk iOS quickstart markdown at runtime (e.g., https://clerk.com/docs/ios/getting-started/quickstart#add-associated-domain-capability) to build a required-step checklist that directly drives implementation decisions, so remote content controls agent instructions.
Audit Metadata