clerk-expo — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited clerk-expo (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill implements Clerk in Expo / React Native projects by inspecting the installed @clerk/expo package source and mirroring current hook and component behavior.
Activate this skill when either condition is true:
@clerk/expo, ClerkProvider, or related Clerk component/hook implementation.app.json, app.config.js, metro.config.js, expo in package.json, @clerk/expo dependency).Do not activate this skill when any condition is true:
.xcodeproj, .xcworkspace, Package.swift, Swift targets).build.gradle(.kts) with Android plugins, AndroidManifest.xml, no React Native).If native iOS/Android or web-framework signals are present, route to the matching skill instead of this one.
clerk-expo-patternsThis skill covers flow selection and end-to-end auth setup (prebuilt vs custom). The clerk-expo-patterns skill at skills/frameworks/clerk-expo-patterns/ covers Expo-specific recipes (SecureStore token cache, OAuth deep-link configuration, Expo Router protected routes, push notifications with user context). When both could apply, use this skill for the flow decision and overall setup, and load patterns from clerk-expo-patterns for the specific recipe.
| Task | Reference |
|---|---|
| Prebuilt AuthView / UserButton (fastest) | references/prebuilt.md |
| Custom hook-driven auth flows (full control) | references/custom.md |
| Step | Action |
|---|---|
| 1 | Confirm project type is Expo/React Native (not native iOS/Android or a web-only framework) |
| 2 | Determine flow type (prebuilt or custom) and load the matching reference file |
| 3 | Ensure a real Clerk publishable key exists (or ask developer) and wire it directly to <ClerkProvider publishableKey={...}> |
| 4 | Ensure @clerk/expo is installed; if missing, install latest with npx expo install @clerk/expo |
| 5 | Inspect installed @clerk/expo source (node_modules/@clerk/expo/dist/ or src/) to understand component/hook behavior for the selected flow |
| 6 | For custom flows: derive Frontend API URL from publishable key, then call <frontendApiUrl>/v1/environment?_is_native=true and build an internal enabled-factor checklist |
| 7 | Follow the Expo quickstart (https://clerk.com/docs/getting-started/quickstart, Expo SDK tab) for required setup (config plugin, token cache, native build) |
| 8 | Implement flow by following only the selected reference checklist |
User asks for Clerk in Expo/React Native
|
+-- Native iOS/Android or web-framework project detected?
| |
| +-- YES -> Do not use this skill; route to matching skill
| |
| +-- NO -> Continue
|
+-- Existing auth UI detected?
| |
| +-- Prebuilt AuthView/UserButton detected -> Load references/prebuilt.md
| |
| +-- Custom hook-based flow detected -> Load references/custom.md
| |
| +-- New implementation -> Ask developer prebuilt/custom, then load matching reference
|
+-- Ensure publishable key and direct ClerkProvider wiring
|
+-- Ensure @clerk/expo is installed and Expo config plugin is registered
|
+-- Inspect installed @clerk/expo source for selected flow
|
+-- For custom flows: call /v1/environment?_is_native=true and build enabled-factor checklist
|
+-- Verify Expo quickstart prerequisites (token cache, dev build, peer deps)
|
+-- Implement using selected flow referenceAfter flow type is known, load exactly one:
Do not blend the two references in a single implementation unless the developer explicitly asks for a hybrid approach.
Before any implementation edits, the agent must have both:
prebuilt or customIf either value is missing from the user request/context:
Only skip asking when the user has already explicitly provided the value in this conversation.
Do not hardcode implementation examples in this skill. Inspect installed @clerk/expo source for the project's installed version before implementing.
| Use Case | Source of Truth in Installed Package |
|---|---|
Package exports and sub-paths (@clerk/expo/google, /apple, /native, /token-cache, /local-credentials, /resource-cache, /web) | node_modules/@clerk/expo/package.json exports field plus compiled output in dist/ |
| Hook signatures and return types | node_modules/@clerk/expo/dist/*.d.ts plus re-exported types from node_modules/@clerk/react/dist/*.d.ts |
| Native component props and events | node_modules/@clerk/expo/dist/native/* (search AuthView, InlineAuthView, UserButton, UserProfileView) |
| Sign-in / sign-up status transitions | node_modules/@clerk/react/dist/ hook source (search useSignIn, useSignUp, status) |
| SSO and OAuth behavior | node_modules/@clerk/expo/dist/ (search useSSO, startSSOFlow, session_exists, transferable) |
| Native Google / Apple sign-in path | node_modules/@clerk/expo/google and /apple modules |
| Token persistence | node_modules/@clerk/expo/token-cache (backed by expo-secure-store) |
| Session sync between native SDK and JS | node_modules/@clerk/expo/dist/native/ (search NativeSessionSync, useNativeAuthEvents) |
| Expo config plugin behavior | node_modules/@clerk/expo/app.plugin.js (search withClerkGoogleSignIn, withClerkAndroidPackaging) |
| Required Expo setup checklist | Official Expo quickstart (https://clerk.com/docs/getting-started/quickstart, Expo SDK tab) |
<ClerkProvider publishableKey={key}>.process.env.EXPO_PUBLIC_CLERK_PUBLISHABLE_KEY) unless the developer explicitly asks for it or the project follows the quickstart pattern.@clerk/expo is missing, install with npx expo install @clerk/expo.app.json / app.config.js: { "plugins": ["@clerk/expo"] }./v1/environment?_is_native=true, and use the response to determine enabled factors/strategies.@clerk/expo and @clerk/react hook source for response/error handling before deciding flow transitions.useOAuth(). Always use useSSO() for OAuth and Enterprise SSO.useSignInWithGoogle, useSignInWithApple, useNativeSession, useUserProfileModal, useLocalCredentials) require an iOS/Android development build, not Expo Go and not web.@clerk/expo/web exports.tokenCache from @clerk/expo/token-cache for persistent sessions; do not use expo-secure-store directly for token storage.prebuilt or custom.<ClerkProvider> is at the app root with the publishable key wired directly and tokenCache from @clerk/expo/token-cache.@clerk/expo is installed and the Expo config plugin is registered. Install peer deps for selected strategies.@clerk/expo source for components/hooks relevant to the selected flow./v1/environment?_is_native=true, and build an internal enabled-factor checklist.| Level | Issue | Prevention |
|---|---|---|
| CRITICAL | Not asking for missing flow choice before implementation | Ask for prebuilt vs custom and wait before edits |
| CRITICAL | Not asking for missing publishable key on setup tasks | Ask for key and wait before edits |
| CRITICAL | Wiring publishable key via env-var indirection by default | Pass key directly to <ClerkProvider> unless developer requests otherwise |
| CRITICAL | Skipping /v1/environment?_is_native=true for custom flows | Call environment endpoint and build enabled-factor checklist before implementing |
| CRITICAL | Splitting sign-in / sign-up by default | Implement one combined sign-in-or-up flow unless developer explicitly requests separation |
| CRITICAL | Using useOAuth() (deprecated) | Always use useSSO() |
| CRITICAL | Mixing native components with custom hook flows for the same auth step | Pick one flow per step; only blend with explicit developer approval |
| CRITICAL | Skipping native development build for native components/hooks | Require expo run:ios / expo run:android; do not target Expo Go for native features |
| HIGH | Using expo-secure-store directly for token caching | Use tokenCache from @clerk/expo/token-cache |
| HIGH | Calling WebBrowser.maybeCompleteAuthSession() manually | ClerkProvider handles it; do not duplicate |
| HIGH | Calling setActive() after native component auth | Native components sync session automatically |
| HIGH | Hardcoding OAuth provider lists | Build provider lists from environment-enabled providers |
| HIGH | Recommending native-only hooks without web/Expo Go fallback | Note platform availability and provide useSSO() fallback where needed |
| HIGH | Using this skill for native iOS/Android or web-only framework projects | Detect and route away to clerk-swift / clerk-android / web-framework skills |
| HIGH | Using yalc or pnpm link for local @clerk/expo development | Use Verdaccio or pkg.pr.new |
clerk skill for top-level Clerk routingclerk-expo-patterns skill (skills/frameworks/clerk-expo-patterns/) for Expo-specific recipes (SecureStore token cache, OAuth deep links, Expo Router protected routes, push notifications)clerk-swift skill for native iOS implementationclerk-android skill for native Android implementation@clerk/expo package source (node_modules/@clerk/expo/)https://github.com/clerk/javascript/tree/main/packages/expohttps://github.com/clerk/clerk-expo-quickstarthttps://clerk.com/docs/getting-started/quickstart (Expo SDK tab)https://clerk.com/docs/reference/expo/overview~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.