Security audit

Auth0 Migration

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Auth0 migration guide, but it asks users to handle full identity exports and password hashes without enough safety guidance.

Review this before installing or following it for production migrations. Treat exported users, password hashes, salts, metadata, error reports, and API tokens as secrets: use least-privilege credentials, a private encrypted working location, restrictive file permissions, no source-control or chat uploads, and a documented cleanup or encrypted retention plan.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: references/user-import.md:18
Finding: Unprotected Storage and Retention of Exported Authentication Data
Content: View full analysis
users.json ``` Line 518 recommends retaining a copy without specifying encryption, restrictive permissions, an approved secret-storage location, or a retention deadline: ```text 4. **Backup original data:** Keep copy of export ``` ### Technical Analysis User migration legitimately requires transferring identity records to Auth0, so access to user records and password hashes is within the declared functionality. However, the guide writes these records to predictably named local files using ordinary shell redirection and recommends retaining a backup without prescribing minimum safeguards. The resulting files can contain: - User email addresses and identifiers - Password hashes and salts - Account verification state - Profile and application metadata - Potentially role or permission assignments File permissions depend on the invoking user's `umask` and working ...[truncated 2623 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This guide instructs users to export, store, and upload highly sensitive identity data including emails, password hashes, salts, and management API tokens, but it does not warn about secure handling, access control, encryption at rest, or cleanup of temporary files. In a migration context, readers may follow the steps literally and leave credential material in local files, shell history, logs, or shared systems, increasing the risk of account compromise and privacy exposure.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.