·
Last changedVersion:
This version passed the hardening gate. Hardening applied 9 targeted changes and preserved all other text. Classified findings before hardening: 1. Classified findings closed: 0. Classified findings remaining: 1. Unclassified scanner findings remaining: 0. Review findings closed: 3. Review findings remaining: 14.
1
1
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
SKILL.md | Excessive Agency & Rogue Autonomy | — | Medium | Open |
1 finding
This skill implements Clerk in native Swift/iOS projects by reading installed package source and mirroring current ClerkKit/ClerkKitUI behavior.
Activate this skill when either condition is true:
.xcodeproj, .xcworkspace, Package.swift, Swift targets).Do not activate this skill when either condition is true:
| Task | Reference |
|---|---|
Prebuilt AuthView / UserButton (fastest) | references/prebuilt.md |
Custom API-driven auth flows (full control) | references/custom.md |
| Step | Action |
|---|---|
1 | Confirm project type is native Swift/iOS and not Expo/React Native |
2 | Determine flow type ( |
3 | Ensure a valid publishable key exists (or ask developer) and wire it directly in configuration |
4 | Ensure |
5 | Inspect installed |
6 | Call |
7 | Find the iOS quickstart URL in the installed |
8 | Verify all quickstart prerequisites for this project |
9 | Implement flow by following only the selected reference checklist |
After flow type is known, load exactly one:
Do not blend the two references in a single implementation unless the developer explicitly asks for a hybrid approach.
Before any implementation edits, the agent must have both:
prebuilt or customIf either value is missing from the user request/context:
Only skip asking when the user has already explicitly provided the value in this conversation.
Do not hardcode implementation examples in this skill. Inspect current installed package source before implementing.
| Use Case | Source of Truth in Installed Package |
|---|---|
SDK package products, platform support, and dependency constraints | Package manifest and target product definitions for |
Publishable key validation and frontend API derivation | Clerk configuration logic (search symbols: |
Environment endpoint contract and field semantics | Environment request path and request construction plus |
iOS quickstart requirements | Installed |
Native Sign in with Apple implementation | Apple capability and native sign-in behavior in selected flow reference |
Clerk.configure.clerk-ios is not installed, add it using the latest available release with an up-to-next-major requirement.ClerkKitUI source and identify which Environment fields gate auth behavior for the selected flow./v1/environment call./v1/environment only after package install and step 5 field-map inspection.ClerkKitUI-aligned field map:
clerk-ios package README, append .md, then visit and read that markdown URL.Add associated domain capability (https://clerk.com/docs/ios/getting-started/quickstart#add-associated-domain-capability) and ensure the associated-domain entry matches quickstart requirements (webcredentials:{YOUR_FRONTEND_API_URL}).custom flow, layout and flow structure must remain materially close to ClerkKitUI AuthView defaults.AuthView.Environment usage/semantics, defer to installed ClerkKitUI behavior and mirror it.prebuilt or custom.Clerk.configure.ClerkKitUI source to map Environment fields used for gating/required behavior in the selected flow./v1/environment and interpret response through the step 8 field map.clerk-ios package README, append .md, then visit and read it.webcredentials:{YOUR_FRONTEND_API_URL} when missing).| Level | Issue | Prevention |
|---|---|---|
CRITICAL | Not asking for missing flow choice before implementation | Ask for |
CRITICAL | Not asking for missing publishable key before implementation | Ask for key and wait before edits |
CRITICAL | Starting implementation before flow type is confirmed | Confirm flow first and load matching reference |
CRITICAL | Using plist/local/env indirection for publishable key without request | Wire key directly in configuration by default |
CRITICAL | Skipping | Always call environment endpoint for both prebuilt and custom flows |
CRITICAL | Calling | Install |
HIGH | Installing | If missing, install latest available release using up-to-next-major requirement |
CRITICAL | Skipping quickstart prerequisite audit | Visit/read quickstart URL from installed |
CRITICAL | Skipping quickstart associated-domain capability step | Execute quickstart |
CRITICAL | Writing capability/required-field matrices into app code | Keep matrices agent-internal and only apply resulting behavior in UI/auth flow code |
CRITICAL | Custom flow layout diverges from | Keep custom screens materially close to |
CRITICAL | Collapsing custom auth into a single all-fields screen | Follow |
CRITICAL | Guessing custom sequencing/gating/ | Reference installed |
HIGH | Using this skill for Expo/React Native | Detect and route away before implementation |
clerk skill for top-level Clerk routingclerk-setup skill for non-native or cross-framework setupclerk-ios package README.md (source for current iOS quickstart link)https://github.com/clerk/clerk-iosGet started with chainctlchainctl skill install public/clerk/clerk-swift:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/clerk/skills/mobile/clerk-swift:latest
MIT
HARDENING.md
SKILL.md
references/custom.md
references/prebuilt.md