Security audit

Auth0 Android

Security checks across malware telemetry and agentic risk

Overview

This is a legitimate Auth0 Android integration skill, but its automatic setup can install a CLI and make persistent Auth0 tenant changes, so it belongs in Review.

Install only if you intend to let an agent modify an Android project for Auth0. Prefer providing an existing Client ID and Domain manually, or verify the exact Auth0 tenant, application, callback URLs, and database connection before using automatic setup. Install the Auth0 CLI yourself from a trusted source and review all project diffs before accepting changes.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/api.md:211

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/integration.md:27

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:94