ClawHub
Back to skill

Security audit

Auth0 Android

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches Auth0 Android setup, but its automatic path can run an unverified online installer and make Auth0 tenant changes beyond a local app integration.

Review the automatic setup path carefully before installing. Prefer manual Auth0 configuration or require the agent to show each proposed tenant change and any local file diff before execution. Do not allow curl-piped installers or writes to /usr/local/bin unless you independently verify the installer source and are comfortable with a persistent CLI being installed.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
references/setup.md:57
Finding

Unpinned Remote Installer Downloaded and Executed Directly

Content
View full analysis

Vulnerability Details

File Location: references/setup.md, lines 57–61
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash
# Install Auth0 CLI
if ! command -v auth0 &> /dev/null; then
  [[ "$OSTYPE" == "darwin"* ]] && brew install auth0/auth0-cli/auth0 || \
  curl -sSfL https://raw.githubusercontent.com/auth0/auth0-cli/main/install.sh | sh -s -- -b /usr/local/bin
fi

Technical Analysis

The automatic setup instructions download an installation script from the mutable main branch of an external GitHub repository and pipe it directly into sh. The script is neither pinned to a reviewed commit or release nor verified using a cryptographic signature or trusted checksum.

Although the URL is associated with Auth0's GitHub organization, its contents can change after this skill has been reviewed. Direct piping also prevents meaningful inspection before execution. Consequently, compromise of the upstream repository, maintainer account, branch, release process, or fetched content could turn this documented installation step into arbitrary command execution.

The command requests installation under /usr/local/bin, a system-wide executable directory that may require elevated privileges. This exceeds the minimum privilege necessary to configure Auth0 for an Android project; a user-owned binary directory or an already installed CLI would be sufficient.

Attack Path

  1. The user selects the documented automatic Auth0 setup workflow.
  2. The system checks for the auth0 command and finds that it is absent.
  3. On the applicable fallback path, curl retrieves the current contents of install.sh from the mutable main branch.
  4. The response is passed directly to sh without pinning, inspection, signature validation, or checksum verification.
  5. If the upstream source or delivered payload has been compromised, attacker-controlled shell commands execute with the privileges of ...[truncated 925 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not pipe network responses directly into a shell. Download the installer to a temporary file first and present it for inspection.
  2. Pin the download to a specific reviewed Auth0 CLI release or immutable commit rather than the mutable main branch.
  3. Verify the downloaded artifact using an Auth0-published cryptographic signature or checksum obtained through a separately trusted channel.
  4. Prefer an authenticated, supported package manager with version pinning where available.
  5. Install into a user-owned directory such as $HOME/.local/bin by default. Request explicit approval before writing to /usr/local/bin or invoking elevated privileges.
  6. Require explicit user confirmation immediately before executing any downloaded installer, clearly stating its source, pinned version, verification result, and destination.
  7. A safer workflow should follow this sequence: select a fixed version, download the artifact without execution, verify its signature or checksum, inspect it, obtain confirmation, and only then execute it with the least privileges necessary.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api.md (reported line 96)May include surrounding context.

Never Log Tokens

Do not log access tokens, ID tokens, or refresh tokens:

kotlin
// BAD

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api.md (reported line 211)May include surrounding context.

md
**Options**:
- `.withScheme()` — URL scheme matching `com_auth0_scheme` in strings.xml (required)
- `.withScope()` — Requested scopes (space-separated)
- `.withAudience()` — Your API identifier for the access token
- `.withOrganization()` — Organization ID or name for SSO
- `.withConnection()` — Force a specific connection (e.g., "google-oauth2")
- `.withPrompt()` — Force login prompt: `"login"` or `"none"`

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/integration.md (reported line 55)May include surrounding context.

md
**Options**:
- `.withScheme()` — URL scheme matching `com_auth0_scheme` in strings.xml (required)
- `.withScope()` — Requested scopes (space-separated)
- `.withAudience()` — Your API identifier for the access token
- `.withOrganization()` — Organization ID or name for SSO
- `.withConnection()` — Force a specific connection (e.g., "google-oauth2")
- `.withPrompt()` — Force login prompt: `"login"` or `"none"`

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/integration.md (reported line 321)May include surrounding context.

md
**Options**:
- `.withScheme()` — URL scheme matching `com_auth0_scheme` in strings.xml (required)
- `.withScope()` — Requested scopes (space-separated)
- `.withAudience()` — Your API identifier for the access token
- `.withOrganization()` — Organization ID or name for SSO
- `.withConnection()` — Force a specific connection (e.g., "google-oauth2")
- `.withPrompt()` — Force login prompt: `"login"` or `"none"`

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The guide suggests falling back to an in-app WebView when no browser is available, even while noting it is not recommended. In-app WebViews are weaker for OAuth/OIDC because they reduce isolation from the app, can expose credentials to app-controlled surfaces, and conflict with current best practices favoring system browsers/custom tabs.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The guide instructs the agent to install external tooling and then use it to authenticate to Auth0 and modify tenant-side resources, expanding the skill from local Android SDK integration into privileged cloud administration. That scope expansion is dangerous because an agent following these steps could create or alter production identity resources, callbacks, and enabled clients with effects outside the local codebase.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The automatic setup script lists apps, creates new Auth0 applications, reads tenant metadata, creates or patches database connections, and enables clients on backend identity resources. In the context of an Android setup skill, these are sensitive administrative actions that can reconfigure the user's Auth0 tenant and potentially affect authentication behavior across environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manual setup path tells the agent to modify strings.xml with user-supplied credentials without a separate confirmation step before editing project files. Even though the values are expected, silent file modification by an agent increases the risk of unintended repository changes and violates safer approval expectations established elsewhere in the same guide.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The manifest description specifically frames the skill around adding authentication to Android apps with Web Auth, biometric-protected credentials, and MFA via the Auth0 Android SDK. This file also instructs on database username/password login, passwordless email authentication, and sign-up/account creation, which are broader identity-management capabilities not reflected in that narrower description.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The user-facing prompt claims only Auth0 credential entries will be added or updated, but the code path that creates a new file also inserts an unrelated app_name resource. This is a trust and integrity issue: the agent is told to represent file changes more narrowly than what the script actually performs.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
98% confidence
Finding

The script fetches a remote installer over the network and pipes it directly into sh, which is a classic supply-chain and remote-code-execution pattern. If the upstream source, transport, or fetched content is compromised, the agent would execute attacker-controlled code on the user's system.

Content

Scanner excerpt · references/setup.md (reported line 60)May include surrounding context.

md
# Install Auth0 CLI
if ! command -v auth0 &> /dev/null; then
  [[ "$OSTYPE" == "darwin"* ]] && brew install auth0/auth0-cli/auth0 || \
  curl -sSfL https://raw.githubusercontent.com/auth0/auth0-cli/main/install.sh | sh -s -- -b /usr/local/bin
fi

# Login

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
references/api.md:211

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
references/integration.md:27

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:94