Security checks for vulnerabilities and agentic risk
Overview
This Auth0 Express skill is purpose-aligned, but its setup and examples include risky authentication practices users should review before installing.
Review this skill before installing or running its setup. Prefer installing the Auth0 CLI through a pinned, verified package manager or release, do not run the downloaded installer as administrator unless necessary, confirm any .env/.env.local writes, and avoid copying examples that return raw tokens or render user claims without escaping.
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T03 · Remote Payload Retrieval and Execution
Error
Location
references/setup.md:51
Finding
Mutable Remote Installer Is Downloaded and Executed Without Integrity Verification
Content
View full analysis
Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
Location
references/api.md:71
Finding
Authentication Tokens Are Disclosed in HTTP Responses
Content
View full analysis
{
// User profile
const user = req.oidc.user;
// Check if authenticated
const isAuth = req.oidc.isAuthenticated();
// ID token
const idToken = req.oidc.idToken;
// ID token claims
const idTokenClaims = req.oidc.idTokenClaims;
res.json({
user,
isAuthenticated: isAuth,
idToken: idToken
});
});
```
From `references/integration.md`:
```javascript
app.get('/user', requiresAuth(), (req, res) => {
res.json({
isAuthenticated: req.oidc.isAuthenticated(),
user: req.oidc.user,
idToken: req.oidc.idToken,
accessToken: req.oidc.accessToken
});
});
```
### Technical Analysis
These examples serialize authentication tokens from a server-managed OpenID Connect session into responses sent to browser clients. This weakens the security boundary provided by a server-side session architecture.
An access token is a bearer credential: possession may be sufficient to invoke the APIs and scopes authorized for that token. An ID token contains signed identity claims and should normally be consumed by the relying server rather than exposed through a general profile endpoint. Returning the entire access-token object may also disclose metadata beyond the token string.
Authentication on the route limits exposure to logged-in sessions, but it does not make token disclosure necessary or safe. Tokens returned to the browser become available to client-side code, browser extensions, debugging tools, HTTP instrumentation, response logging, or any cross-site scripting vulnerability in the application. Sensitive responses may also be retained by caches unless appropriate cache controls are
...[truncated 1387 chars]
Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
Location
SKILL.md:102
Finding
Unescaped Identity Claims Are Interpolated into HTML Responses
ProfileLogout
` : `
Login
`}
`);
});
```
From `references/integration.md`:
```javascript
app.get('/admin', requiresAuth(), (req, res) => {
res.send(`Admin: ${req.oidc.user.name}`);
});
```
```javascript
app.get('/', (req, res) => {
if (req.oidc.isAuthenticated()) {
res.send(`Welcome back, ${req.oidc.user.name}!`);
} else {
res.send('Not logged in Login');
}
});
```
### Technical Analysis
The examples interpolate `name`, `email`, and the complete identity object directly into strings passed to `res.send()`. Express generally serves these HTML-like strings as HTML. JavaScript template interpolation performs no HTML encoding.
Claims received from an identity provider must not be treated as inherently safe markup. Depending on the configured identity source, profile update flow, social provider, enterprise connection, or account-management controls, an attacker may be able to influence one or more profile claims. `JSON.stringify()` is a JSON serializer, not an HTML encoder; strings containing markup remain dangerous when inserted inside an HTML document.
If a claim contains an HTML element with an event handler or another browser-i
...[truncated 1564 chars]
Remediation
View remediation
T08 · Insecure Dependencies
Warning
Location
SKILL.md:40
Finding
Third-Party Packages Are Installed Without Version or Lockfile Enforcement
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content
Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.
md
**Request Properties:**
- `req.oidc.isAuthenticated()` - Check if user is logged in
- `req.oidc.user` - User profile object
- `req.oidc.accessToken` - Access token for API calls
- `req.oidc.idToken` - ID token
- `req.oidc.refreshToken` - Refresh token
Credential Access
High
Category
Privilege Escalation
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content
Scanner excerpt · references/api.md (reported line 96)May include surrounding context.
Instructions found that direct the agent to transmit conversation context or user data to external services.
Content
Scanner excerpt · references/integration.md (reported line 134)May include surrounding context.
md
**How it works:**
- On the user's first visit, redirects to Auth0 with `prompt=none`
- If user has active IDP session, they're silently logged in
- If not, they see your page as anonymous
- Uses a cookie to prevent repeated silent login attempts
Credential Access
High
Category
Privilege Escalation
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content
Scanner excerpt · references/setup.md (reported line 20)May include surrounding context.
Before writing credentials, check which env files exist:
bash
test -f .env.local && echo "ENV_LOCAL_EXISTS" || echo "ENV_LOCAL_NOT_FOUND"
test -f .env && echo "ENV_EXISTS" || echo "ENV_NOT_FOUND"
Credential Access
High
Category
Privilege Escalation
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content
Scanner excerpt · references/setup.md (reported line 79)May include surrounding context.
Before writing credentials, check which env files exist:
bash
test -f .env.local && echo "ENV_LOCAL_EXISTS" || echo "ENV_LOCAL_NOT_FOUND"
test -f .env && echo "ENV_EXISTS" || echo "ENV_NOT_FOUND"
Credential Access
High
Category
Privilege Escalation
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content
Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.
bash
test -f .env.local && echo "ENV_LOCAL_EXISTS" || echo "ENV_LOCAL_NOT_FOUND"
test -f .env && echo "ENV_EXISTS" || echo "ENV_NOT_FOUND"
Then ask the user for explicit confirmation before proceeding — do not continue until the user confirms:
Credential Access
High
Category
Privilege Escalation
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content
Scanner excerpt · references/setup.md (reported line 21)May include surrounding context.
bash
test -f .env.local && echo "ENV_LOCAL_EXISTS" || echo "ENV_LOCAL_NOT_FOUND"
test -f .env && echo "ENV_EXISTS" || echo "ENV_NOT_FOUND"
Then ask the user for explicit confirmation before proceeding — do not continue until the user confirms:
Credential Access
High
Category
Privilege Escalation
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content
Scanner excerpt · references/setup.md (reported line 81)May include surrounding context.
bash
test -f .env.local && echo "ENV_LOCAL_EXISTS" || echo "ENV_LOCAL_NOT_FOUND"
test -f .env && echo "ENV_EXISTS" || echo "ENV_NOT_FOUND"
Then ask the user for explicit confirmation before proceeding — do not continue until the user confirms:
Credential Access
High
Category
Privilege Escalation
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content
Scanner excerpt · references/setup.md (reported line 113)May include surrounding context.
bash
test -f .env.local && echo "ENV_LOCAL_EXISTS" || echo "ENV_LOCAL_NOT_FOUND"
test -f .env && echo "ENV_EXISTS" || echo "ENV_NOT_FOUND"
Then ask the user for explicit confirmation before proceeding — do not continue until the user confirms:
Credential Access
High
Category
Privilege Escalation
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content
Scanner excerpt · references/setup.md (reported line 28)May include surrounding context.
md
- If `.env.local` exists, ask:
- Question: "A `.env.local` file already exists and may contain secrets unrelated to Auth0. This setup will append Auth0 credentials to it without modifying existing content. Do you want to proceed?"
- Options: "Yes, append to existing .env.local" / "No, I'll update it manually"
- If `.env.local` does **not** exist but `.env` exists, ask:
- Question: "A `.env` file already exists and may contain secrets unrelated to Auth0. This setup will append Auth0 credentials to it without modifying existing content. Do you want to proceed?"
Credential Access
High
Category
Privilege Escalation
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content
Scanner excerpt · references/setup.md (reported line 36)May include surrounding context.
md
- If `.env.local` exists, ask:
- Question: "A `.env.local` file already exists and may contain secrets unrelated to Auth0. This setup will append Auth0 credentials to it without modifying existing content. Do you want to proceed?"
- Options: "Yes, append to existing .env.local" / "No, I'll update it manually"
- If `.env.local` does **not** exist but `.env` exists, ask:
- Question: "A `.env` file already exists and may contain secrets unrelated to Auth0. This setup will append Auth0 credentials to it without modifying existing content. Do you want to proceed?"
Credential Access
High
Category
Privilege Escalation
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content
Scanner excerpt · references/setup.md (reported line 80)May include surrounding context.
md
- If `.env.local` exists, ask:
- Question: "A `.env.local` file already exists and may contain secrets unrelated to Auth0. This setup will append Auth0 credentials to it without modifying existing content. Do you want to proceed?"
- Options: "Yes, append to existing .env.local" / "No, I'll update it manually"
- If `.env.local` does **not** exist but `.env` exists, ask:
- Question: "A `.env` file already exists and may contain secrets unrelated to Auth0. This setup will append Auth0 credentials to it without modifying existing content. Do you want to proceed?"
Credential Access
High
Category
Privilege Escalation
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content
Scanner excerpt · references/setup.md (reported line 84)May include surrounding context.
md
- If `.env.local` exists, ask:
- Question: "A `.env.local` file already exists and may contain secrets unrelated to Auth0. This setup will append Auth0 credentials to it without modifying existing content. Do you want to proceed?"
- Options: "Yes, append to existing .env.local" / "No, I'll update it manually"
- If `.env.local` does **not** exist but `.env` exists, ask:
- Question: "A `.env` file already exists and may contain secrets unrelated to Auth0. This setup will append Auth0 credentials to it without modifying existing content. Do you want to proceed?"
Credential Access
High
Category
Privilege Escalation
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content
Scanner excerpt · references/setup.md (reported line 32)May include surrounding context.
md
- If `.env.local` does **not** exist but `.env` exists, ask:
- Question: "A `.env` file already exists and may contain secrets unrelated to Auth0. This setup will append Auth0 credentials to it without modifying existing content. Do you want to proceed?"
- Options: "Yes, append to existing .env" / "No, I'll update it manually"
- If neither exists, ask:
- Question: "This setup will create a `.env.local` file containing Auth0 credentials (CLIENT_ID, ISSUER_BASE_URL, SECRET) and a placeholder for CLIENT_SECRET. Do you want to proceed?"
Credential Access
High
Category
Privilege Escalation
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content
Scanner excerpt · references/setup.md (reported line 82)May include surrounding context.
md
- If `.env.local` does **not** exist but `.env` exists, ask:
- Question: "A `.env` file already exists and may contain secrets unrelated to Auth0. This setup will append Auth0 credentials to it without modifying existing content. Do you want to proceed?"
- Options: "Yes, append to existing .env" / "No, I'll update it manually"
- If neither exists, ask:
- Question: "This setup will create a `.env.local` file containing Auth0 credentials (CLIENT_ID, ISSUER_BASE_URL, SECRET) and a placeholder for CLIENT_SECRET. Do you want to proceed?"
Tool Parameter Abuse
High
Category
Tool Misuse
Confidence
85% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content
Scanner excerpt · references/setup.md (reported line 54)May include surrounding context.
md
curl -sSfL https://raw.githubusercontent.com/auth0/auth0-cli/main/install.sh -o /tmp/auth0-install.sh
echo "⚠️ Review the install script at /tmp/auth0-install.sh before running"
sh /tmp/auth0-install.sh -b /usr/local/bin
rm /tmp/auth0-install.sh
fi
fi
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
The example returns the full user object and the raw ID token from a route response. While the route is authenticated, exposing tokens and unnecessary identity attributes to the browser or API consumers increases the chance of token leakage via frontend code, logs, browser extensions, or downstream integrations, and encourages insecure copy-paste use by developers.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding
The example forwards access_token in an Authorization header to https://your-api.com/data, which is a privacy- and security-relevant network operation. The surrounding documentation explains how to do it but does not explicitly warn that tokens should only be sent to trusted endpoints over HTTPS and scoped minimally.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding
The example exposes req.oidc.user, idToken, and accessToken directly in an HTTP response. Even on an authenticated route, returning raw tokens and full identity objects to the browser or downstream clients can leak bearer credentials and sensitive claims, enabling token theft, replay, or unintended disclosure through logs, browser storage, or client-side code.
Content
No source excerpt is available for this finding.
Intent-Code Divergence
Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding
The document explicitly requires user confirmation before any env-file write, but the provided automation script itself performs unconditional writes once run. In an agent-skill context, operators may treat the script as approved automation and execute it directly, bypassing the stated safeguard and modifying sensitive configuration files without a live consent gate.
Content
No source excerpt is available for this finding.
Intent-Code Divergence
Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding
The guide says the downloaded install script should be reviewed before execution, but the next command immediately executes that remote script and then deletes it. This undermines the safety instruction and creates a supply-chain risk: a compromised upstream script would be run locally with little opportunity for inspection.
Content
No source excerpt is available for this finding.
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
