Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent Auth0 MFA guide, but users should handle the included tenant and authenticator management commands carefully.
Before installing or using this skill, make sure the agent is working on an authorized Auth0 tenant. Review generated Auth0 CLI and Management API commands before running them, especially policy changes, Action deployments, and authenticator deletion commands that can affect login access or account recovery.
The manifest description says to use the skill when adding MFA, 2FA, SMS codes, push notifications, passkeys, or step-up verification, which is a wide set of common authentication topics. It does not provide explicit boundaries or negative examples to clarify when this skill should be selected versus other Auth0 or general auth skills.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Get user's enrolled authenticators
curl -X GET "https://YOUR_DOMAIN/api/v2/users/USER_ID/authenticators" \
-H "Authorization: Bearer MGMT_TOKEN"
The section provides a DELETE request that removes a user's authenticator enrollment, which can affect account access and recovery, but the surrounding markdown gives no warning about the operational impact or need for caution. Under the markdown criteria, destructive actions affecting user account state should be disclosed clearly.
No suspicious patterns detected.