ClawHub
Back to skill

Security audit

Auth0 Java Mvc Common

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent Convex authentication setup guide, with expected auth configuration and credential-related steps but no artifact-backed evidence of hidden or malicious behavior.

Install only if you want an agent to help modify a Convex app's authentication setup. Review any package installs, provider CLI actions, and environment variable writes before approving them, and keep provider secrets out of commits and logs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill explicitly instructs the agent to use provided Auth0 credentials and write them to a local `.env` file without an immediate user-facing warning, consent step, or preference for safer secret stores. Even though `.env` is common in development, agent-driven handling of client secrets increases the chance of accidental disclosure through workspace files, logs, shell history, or later commits.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The automatic setup path tells the agent to create an Auth0 application and then write the returned domain, client ID, and client secret to `.env` immediately, but the warning about secret handling appears later and not at the action point. This can normalize unsafe secret persistence by default and may cause sensitive credentials to be stored in plaintext on disk without the user's informed consent.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The manual path instructs the agent to ask the user for the client secret and then write a `.env` file, creating a direct secret-collection workflow inside the agent. In skill context, this is more dangerous because the agent is handling real authentication credentials for a web application, so any mishandling could expose tenant access or enable unauthorized use of the Auth0 app configuration.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
references/integration.md:118