·
Last changedVersion:
This version passed the hardening gate. Hardening applied 2 targeted changes and preserved all other text. Classified findings before hardening: 2. Classified findings closed: 2. Classified findings remaining: 0. Unclassified scanner findings remaining: 0. Review findings closed: 0. Review findings remaining: 8.
2
None
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
references/prebuilt.md | Prompt Injection | Third-party content as instructions | Low | Closed | |
references/custom.md | Prompt Injection | Third-party content as instructions | Low | Closed |
2 findings
This skill implements Clerk in native Android projects by following current clerk-android SDK and docs patterns.
Activate this skill when either condition is true:
build.gradle(.kts) with Android plugins, AndroidManifest.xml, app/src/main/java, Compose UI files).Do not activate this skill when either condition is true:
If Expo/React Native signals are present, route to the general setup skill instead.
| Task | Reference |
|---|---|
Prebuilt AuthView / UserButton (fastest) | references/prebuilt.md |
Custom API-driven auth flows (full control) | references/custom.md |
| Step | Action |
|---|---|
1 | Confirm project type is native Android and not Expo/React Native |
2 | Determine flow type ( |
3 | Ensure a real Clerk publishable key exists (or ask developer) |
4 | Ensure correct Clerk artifacts are installed for the selected flow |
5 | Read official Android quickstart and verify required setup (Native API, min SDK/Java, manifest, initialization) |
6 | Inspect |
7 | Implement flow by following only the selected reference checklist |
After flow type is known, load exactly one:
Do not blend the two references in a single implementation unless the developer explicitly asks for a hybrid approach.
Before any implementation edits, the agent must have both:
prebuilt or customIf either value is missing from the user request/context:
Only skip asking when the user has already explicitly provided the value in this conversation.
Do not hardcode implementation examples in this skill. Inspect current clerk-android source/docs for the installed SDK version before implementing.
| Use Case | Source of Truth |
|---|---|
SDK artifacts and dependency split ( |
|
SDK initialization and publishable key wiring | Android quickstart and |
Prebuilt auth and profile behavior |
|
Custom auth sequencing and factor handling |
|
Capability/feature gating from instance settings |
|
Required Android setup checklist | Official Android quickstart ( |
Clerk.initialize(...).clerk-android-ui (includes API).clerk-android-api unless prebuilt components are explicitly requested.Clerk.isInitialized) before assuming auth-ready state.custom flow, preserve multi-step auth progression and factor-specific handling (no single all-fields form by default).prebuilt flow, do not rebuild auth forms with custom API calls unless explicitly requested.AuthView/UserButton as default building blocks.prebuilt or custom.Clerk.initialize(...) path and publishable key wiring are valid.| Level | Issue | Prevention |
|---|---|---|
CRITICAL | Not asking for missing flow choice before implementation | Ask for |
CRITICAL | Not asking for missing publishable key before implementation | Ask for key and wait before edits |
CRITICAL | Starting implementation before flow type is confirmed | Confirm flow first and load matching reference |
CRITICAL | Skipping Android quickstart prerequisites | Verify and apply required setup from official Android quickstart |
CRITICAL | Missing app-level | Initialize Clerk from |
HIGH | Wrong artifact for chosen flow | Prebuilt: |
HIGH | Rendering auth UI before SDK initialization completes | Gate UI with |
HIGH | Hardcoding auth factors/social providers | Drive behavior from Clerk runtime capability fields |
HIGH | Using this skill for Expo/React Native | Detect and route away before implementation |
clerk skill for top-level Clerk routingclerk-setup skill for cross-framework quickstart setuphttps://github.com/clerk/clerk-androidhttps://clerk.com/docs/android/getting-started/quickstartGet started with chainctlchainctl skill install public/clerk/clerk-android:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/clerk/skills/mobile/clerk-android:latest
MIT
HARDENING.md
SKILL.md
references/custom.md
references/prebuilt.md