ClawHub
Back to skill

Security audit

Auth0 React

Security checks for vulnerabilities and agentic risk

Overview

This is a deprecated Auth0 React skill that openly redirects users to install a replacement skill, with a supply-chain caution around its unpinned install command.

Before installing, review the replacement `auth0` skill and prefer a pinned or otherwise trusted ClawHub installer invocation when available. Run the install from a normal least-privilege shell rather than an environment containing production secrets.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:37
Finding

Unpinned Remote Package Execution Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:37-42
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

markdown
ClawHub does **not** install the replacement automatically. When you download
this outdated skill, install the consolidated one by running:

```bash
npx clawhub install auth0
text

The same unpinned command is advertised in the Skill metadata at `SKILL.md:3-7`:

```yaml
description: >-
  Deprecated — use the `auth0` skill instead (run `npx clawhub install auth0`).
  Use when adding Auth0 login, logout, protected routes, or user sessions to a
  React SPA. Integrates @auth0/auth0-react — use even if the user says "add
  login to my React app" or "protect my React routes" without naming the SDK.

Technical Analysis

The documented npx clawhub install auth0 command does not pin the clawhub package to an audited version or verify its integrity. Depending on the local npm environment, npx can download the currently resolved package from a configured registry and execute its package entry point. The command subsequently installs additional remotely maintained Skill content identified only as auth0.

Consequently, the code and Skill instructions ultimately loaded by the user can differ from the content that existed when this repository was reviewed. Compromise of the npm package, package ownership, configured registry, or replacement Skill could convert this installation instruction into a supply-chain execution path.

Attack Path

  1. An attacker compromises the resolved clawhub npm package, its publisher account, the relevant registry path, or the remotely hosted auth0 Skill.
  2. The attacker publishes a malicious package version or modifies the replacement Skill content.
  3. A user follows the instruction and runs npx clawhub install auth0.
  4. npx resolves and executes the unpinned package using the invoking user's privileges.
  5. Malici ...[truncated 990 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the installer to a specific reviewed version, for example npx clawhub@<audited-version> install auth0.
  2. Use npm lockfiles and integrity metadata where the installation workflow supports them.
  3. Explicitly identify the trusted npm registry and avoid relying on arbitrary user-level registry configuration.
  4. Prefer a locally installed, reviewed installer invoked with a mode that prevents implicit downloads.
  5. Pin the replacement Skill to an immutable release, commit, or cryptographic digest.
  6. Verify package signatures or checksums before executing the installer.
  7. Review the downloaded replacement Skill before enabling it.
  8. Run installation with least privilege and avoid executing it in environments containing production credentials or high-value CI secrets.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

MCP server references in the skill manifest without version pinning are a rug-pull risk.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The skill metadata instructs users to run npx clawhub install auth0 without pinning a package version. Using npx this way can fetch whatever version is current at execution time, which creates a supply-chain risk if a malicious or compromised release is published or if behavior changes unexpectedly.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The deprecated skill tells users to execute npx clawhub install auth0, again without a version pin. Because this is a direct user-facing command, it could cause execution of an unintended or newly published package version, increasing supply-chain exposure.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The manifest says to use the skill even when the user says phrases like "add login to my React app" or "protect my React routes" without naming Auth0. While React-specific context helps, these examples are still broad natural-language requests and the file does not provide exclusion conditions or tighter trigger boundaries, which can increase unintended invocation risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.