Auth0 Spa Js

PassAudited by VirusTotal on May 6, 2026.

Overview

Type: OpenClaw Skill Name: auth0-spa-js Version: 1.0.1 The skill bundle is a legitimate tool for integrating the Auth0 SPA SDK into web applications. It includes a Node.js bootstrap script (`scripts/bootstrap.mjs`) and documentation that guide an AI agent through installing dependencies, configuring Auth0 via the official CLI, and setting up environment variables. The instructions in `SKILL.md` and `setup.md` are task-aligned and include proactive safety warnings regarding the handling of `.env` files and automated build verification.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Concern

ASI03: Identity and Privilege Abuse

What this means

If run in a project with secrets in .env, the helper loads those secrets into the bootstrap process while updating Auth0 configuration.

Why it was flagged

The bootstrap helper reads the full existing .env file before merging Auth0 values. Existing .env files may contain unrelated secrets, and this contrasts with the setup guide's warning not to read .env contents during setup.

Skill content

if (fs.existsSync(envFilePath)) {
      content = fs.readFileSync(envFilePath, "utf-8")
    }

Recommendation

Review the script before running it. Prefer manually adding only the Auth0 domain and client ID, or modify the helper to append/update only known Auth0 keys without reading unrelated secret values.

Note

ASI03: Identity and Privilege Abuse

What this means

Running the bootstrap can make persistent changes in your Auth0 tenant, not just in your local project files.

Why it was flagged

The automation can use the logged-in Auth0 CLI account to change tenant configuration by enabling the new client on an Auth0 database connection.

Skill content

await auth0ApiCall("patch", `connections/${existing.id}`, {
        enabled_clients: updatedClients,
      })

Recommendation

Run it only while logged into the intended Auth0 tenant, inspect the displayed change plan, and confirm that updating the database connection is desired.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

If followed, this runs code downloaded from GitHub on the user's machine.

Why it was flagged

The setup guide documents installing Auth0 CLI by piping a remote script to the shell. This is a common CLI install pattern but depends on the remote script source at install time.

Skill content

curl -sSfL https://raw.githubusercontent.com/auth0/auth0-cli/main/install.sh | sh -s -- -b /usr/local/bin

Recommendation

Use Auth0's official installation instructions, verify the source, or prefer a package-manager installation when possible.

Note

ASI05: Unexpected Code Execution

What this means

The agent may execute the project's build commands and make repeated code changes during verification.

Why it was flagged

The skill tells the agent to run the project's build script and iteratively fix build errors. This is normal for a coding integration task, but npm scripts execute local project-defined commands.

Skill content

After completing the integration, build the project to verify it compiles successfully:
> ```bash
> npm run build
> ```
> If the build fails, analyze the error output and fix the issues.

Recommendation

Use in trusted project directories and review changes after the build-fix loop.