·
Last changedVersion:
This version passed the hardening gate. Hardening updated the skill content and independently checked the resulting changes. Classified findings before hardening: 1. Classified findings closed: 0. Classified findings remaining: 1. Unclassified scanner findings remaining: 0. Review findings closed: 10. Review findings remaining: 2.
1
1
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
SKILL.md | Supply Chain & Install-Time Trust | — | Medium | Open |
1 finding
| Framework | Documentation |
|---|---|
Overview | |
Playwright | https://clerk.com/docs/guides/development/testing/playwright/overview |
Cypress | https://clerk.com/docs/guides/development/testing/cypress/overview |
Test auth = isolated session state. Each test needs fresh auth context.
clerkSetup() initializes test environmentsetupClerkTestingToken() bypasses bot detectionstorageState persists auth between tests for speedpk_test_* / sk_test_*). If the project has no keys yet, either copy development-instance keys from the Clerk Dashboard, or have the user run npx clerk@latest init (the Clerk CLI; see clerk-setup), which creates a Clerk application and writes development-instance keys to the env file. No Clerk account or Dashboard visit is needed for that path.
Before that command runs:
setupClerkTestingToken() before navigating to auth pages, and only with development-instance keyspk_test_xxx, sk_test_xxxpk_test_* / sk_test_* and stop if any other keys are foundstorageState for faster tests; write it to a dedicated folder covered by the git ignore rules and leave it out of CI artifact uploadspage.waitForSelector('[data-clerk-component]') for Clerk UI| Pattern | Problem | Fix |
|---|---|---|
Production keys in tests | Security risk | Use |
No | Auth fails | Call before navigation |
UI-based sign-in every test | Slow tests | Use |
Playwright: Use globalSetup for auth state, stored in the same git ignored folder
Cypress: Add addClerkCommands({ Cypress, cy }) to support file
clerk-setup - Install Clerk before adding testsclerk-nextjs-patterns - Next.js patterns being testedGet started with chainctlchainctl skill install public/clerk/clerk-testing:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/clerk/skills/features/clerk-testing:latest
MIT
HARDENING.md
SKILL.md