ClawHub
Back to skill

Security audit

Auth0 Spa Js

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for Auth0 SPA setup, but its setup path can execute unverified remote installer code and make persistent Auth0 tenant/project changes.

Review this skill before installing. Prefer manual Auth0 CLI installation through a trusted package manager or verified release instead of any curl-to-sh command, run the bootstrap only in the intended project, confirm the displayed Auth0 tenant changes, and inspect or back up existing .env configuration before allowing updates.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
references/setup.md:46
Finding

Mutable Remote Installer Is Downloaded and Executed Without Verification

Content
View full analysis

Vulnerability Details

File Location: references/setup.md:40-50 and references/setup.md:195-206
Vulnerability Type: Unverified remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash
# Install Auth0 CLI if needed
if ! command -v auth0 &> /dev/null; then
  echo "Installing Auth0 CLI..."
  if [[ "$OSTYPE" == "darwin"* ]]; then
    brew install auth0/auth0-cli/auth0
  elif [[ "$OSTYPE" == "linux-gnu"* ]]; then
    curl -sSfL https://raw.githubusercontent.com/auth0/auth0-cli/main/install.sh | sh -s -- -b /usr/local/bin
  else
    echo "Please install Auth0 CLI: https://github.com/auth0/auth0-cli#installation"
    exit 1
  fi
fi

The manual installation section repeats the unsafe pattern:

bash
**Linux:**
```bash
curl -sSfL https://raw.githubusercontent.com/auth0/auth0-cli/main/install.sh | sh
text

### Technical Analysis

The setup guide retrieves a shell script from the mutable `main` branch of a remote GitHub repository and immediately passes it to `sh`. There is no version pinning, checksum validation, signature verification, or opportunity to inspect the downloaded content before execution.

Although the URL belongs to Auth0's official GitHub organization, using a mutable branch means the effective executable payload can change after this Skill has been reviewed. Compromise of the upstream repository, maintainer account, release process, or content-delivery path could turn these instructions into an arbitrary command-execution channel.

The automated variant requests installation into `/usr/local/bin`. It will only succeed if the invoking environment has the necessary permissions, but this path may involve elevated or shared-system filesystem access.

This behavior is not required to implement Auth0 SPA authentication. A versioned package-manager installation or verified release artifact would provide the needed CLI without directly execut
...[truncated 1180 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove all curl | sh installation instructions.
  2. Prefer an official package manager with a pinned or otherwise controlled version.
  3. If direct artifact installation is unavoidable:
    • Pin a specific release version or immutable commit.
    • Download the artifact to a local file instead of piping it to a shell.
    • Verify a vendor-published cryptographic signature or SHA-256 checksum.
    • Display or inspect the script before execution.
    • Execute it only after explicit user confirmation.
  4. Install into a user-owned directory unless system-wide installation is explicitly required.
  5. Document the exact files and permissions the installer requires.
  6. Replace both affected commands with the hardened process so the manual and automated instructions remain consistent.

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/utils/validation.mjs:28
Finding

Bootstrap Error Message Recommends Direct Execution of a Mutable Remote Script

Content
View full analysis

Vulnerability Details

File Location: scripts/utils/validation.mjs:19-31
Vulnerability Type: Unsafe remote installer recommendation
Risk Level: High

Vulnerable Code

javascript
export async function checkAuth0CLI() {
  const spinner = ora("Checking Auth0 CLI").start()
  try {
    await $`auth0 --version --no-input`
    spinner.succeed("Auth0 CLI found")
  } catch {
    spinner.fail("Auth0 CLI not found")
    console.error("\n  Install Auth0 CLI: https://github.com/auth0/auth0-cli#installation")
    console.error("  macOS:   brew install auth0/auth0-cli/auth0")
    console.error("  Linux:   curl -sSfL https://raw.githubusercontent.com/auth0/auth0-cli/main/install.sh | sh")
    console.error("  Windows: scoop install auth0\n")
    process.exit(1)
  }
}

Technical Analysis

The bootstrap does not automatically execute the remote installer, but it presents users with a copy-and-paste command that downloads the mutable main-branch script and pipes it directly into a shell. Following the generated remediation command therefore creates the same remote code-execution and supply-chain exposure as the setup guide.

The URL is associated with the declared Auth0 functionality, and no evidence indicates intentional credential exfiltration. Nevertheless, execution of unaudited network content is avoidable and exceeds the minimum mechanism necessary to tell users how to install the CLI safely.

Attack Path

  1. The Auth0 CLI is absent from the local environment.
  2. The bootstrap invokes checkAuth0CLI() and prints the Linux installation command.
  3. An attacker compromises or maliciously changes the remote main/install.sh content.
  4. The user copies and executes the displayed command.
  5. The remote response is passed directly to sh.
  6. Attacker-controlled commands run with the user's current privileges.

Impact Assessment

Exploitation can result in arbitrary code execu ...[truncated 338 chars]

Remediation
View remediation

Remediation Suggestions

Replace the printed pipe-to-shell command with a safe installation reference or verified procedure. For example:

  1. Direct users to an official versioned release page.
  2. Require downloading a specific release artifact.
  3. Provide the expected signature or SHA-256 checksum and verification command.
  4. Install the verified artifact into a user-owned executable directory.
  5. Require explicit confirmation before any installation or system-wide file modification.
  6. Keep the displayed instructions synchronized with the hardened procedure in references/setup.md.

T08 · Insecure Dependencies

Warning
Location
scripts/package.json:9
Finding

Runtime Dependencies Are Not Locked to Reproducible Artifacts

Content
View full analysis

Vulnerability Details

File Location: scripts/package.json:9-13
Vulnerability Type: Non-reproducible third-party dependency resolution
Risk Level: Medium

Vulnerable Code

json
"dependencies": {
  "@inquirer/prompts": "^8.1.0",
  "execa": "^9.0.0",
  "ora": "^8.0.0"
}

No dependency lockfile is present in the audited project structure.

Technical Analysis

Each runtime dependency uses a caret range, allowing future semver-compatible releases to be selected during installation. Without an integrity-bearing lockfile, the code installed later may differ from the dependency versions represented when the Skill was audited.

This is particularly relevant because the bootstrap imports and executes these packages. Package installation may also run dependency lifecycle behavior where permitted by the package manager. There is no evidence that the named packages are currently malicious or typosquatted; the vulnerability is the lack of deterministic, integrity-checked resolution.

Attack Path

  1. A dependency publisher account or package publication process is compromised.
  2. An attacker publishes a malicious release satisfying one of the declared caret ranges.
  3. A user installs the bootstrap dependencies without a lockfile.
  4. The package manager resolves the new malicious version.
  5. Malicious code executes during an allowed installation lifecycle or when the bootstrap imports the dependency.

Impact Assessment

A compromised resolved dependency would execute with the privileges of the user installing or running the bootstrap. It could access the project directory, process environment, Auth0 CLI authentication state, and any tenant operations available to that user. The practical likelihood depends on compromise of one of the upstream dependencies or its publication chain.

Remediation
View remediation

Remediation Suggestions

  1. Generate and commit an integrity-bearing lockfile for the scripts package.
  2. Use deterministic installation such as npm ci in automated workflows.
  3. Pin reviewed dependency versions or update them only through a controlled review process.
  4. Enable dependency vulnerability and provenance monitoring.
  5. Review lockfile changes before merging dependency updates.
  6. Where supported, require package provenance and disable unnecessary install scripts.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (39)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

}

text

### 5. Get Access Tokens for API Calls

```js
const accessToken = await auth0.getTokenSilently();

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api.md (reported line 17)May include surrounding context.

md
| `clientId` | `string` | Yes | SPA application Client ID from Auth0 Dashboard |
| `authorizationParams` | `AuthorizationParams` | No | Authorization request parameters |
| `authorizationParams.redirect_uri` | `string` | No | Where Auth0 redirects after login (default: `window.location.origin`) |
| `authorizationParams.audience` | `string` | No | API identifier (e.g., `https://api.example.com`) for access tokens |
| `authorizationParams.scope` | `string` | No | Space-separated OIDC scopes (default: `openid profile email`) |
| `authorizationParams.organization` | `string` | No | Organization ID or name for multi-tenant apps |
| `useRefreshTokens` | `boolean` | No | Enable refresh token rotation (default: `false`) |

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/integration.md (reported line 331)May include surrounding context.

md
| `clientId` | `string` | Yes | SPA application Client ID from Auth0 Dashboard |
| `authorizationParams` | `AuthorizationParams` | No | Authorization request parameters |
| `authorizationParams.redirect_uri` | `string` | No | Where Auth0 redirects after login (default: `window.location.origin`) |
| `authorizationParams.audience` | `string` | No | API identifier (e.g., `https://api.example.com`) for access tokens |
| `authorizationParams.scope` | `string` | No | Space-separated OIDC scopes (default: `openid profile email`) |
| `authorizationParams.organization` | `string` | No | Organization ID or name for multi-tenant apps |
| `useRefreshTokens` | `boolean` | No | Enable refresh token rotation (default: `false`) |

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api.md (reported line 100)May include surrounding context.

md
| `locale` | `string` | User locale |
| `updated_at` | `string` | Last profile update ISO timestamp |

Claims on the **access token** (from `getTokenSilently({ detailedResponse: true })`):

| Claim | Description |
|-------|-------------|

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/integration.md (reported line 185)May include surrounding context.

md
| `locale` | `string` | User locale |
| `updated_at` | `string` | Last profile update ISO timestamp |

Claims on the **access token** (from `getTokenSilently({ detailedResponse: true })`):

| Claim | Description |
|-------|-------------|

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/integration.md (reported line 431)May include surrounding context.

md
| `locale` | `string` | User locale |
| `updated_at` | `string` | Last profile update ISO timestamp |

Claims on the **access token** (from `getTokenSilently({ detailedResponse: true })`):

| Claim | Description |
|-------|-------------|

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api.md (reported line 127)May include surrounding context.

md
### Token Management

- [ ] `getTokenSilently()` returns a JWT string
- [ ] Access token decoded at [jwt.io](https://jwt.io) shows correct `aud`, `iss`, `sub`
- [ ] Tokens are **not** stored in `localStorage` (DevTools → Application → Local Storage)
- [ ] Page refresh maintains authentication (silent auth via `checkSession`)
- [ ] `getTokenSilently()` works without redirecting when session is active

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

The | sh chain is dangerous because it removes any opportunity for inspection between retrieval and execution, turning a documentation step into a direct code-execution primitive. In an agent skill context, such command chains are especially risky because users or tools may copy-paste or automate them without scrutiny.

Content

Scanner excerpt · references/setup.md (reported line 204)May include surrounding context.

Linux:

bash
curl -sSfL https://raw.githubusercontent.com/auth0/auth0-cli/main/install.sh | sh

Windows:

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 13)May include surrounding context.

md
import ora from "ora"

/**
 * Write or update an .env file with the provided key-value pairs.
 * Merges with existing content — preserves unrelated entries.
 */
export async function writeEnvFile(config, envFilePath) {

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 18)May include surrounding context.

md
import ora from "ora"

/**
 * Write or update an .env file with the provided key-value pairs.
 * Merges with existing content — preserves unrelated entries.
 */
export async function writeEnvFile(config, envFilePath) {

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 108)May include surrounding context.

md
import ora from "ora"

/**
 * Write or update an .env file with the provided key-value pairs.
 * Merges with existing content — preserves unrelated entries.
 */
export async function writeEnvFile(config, envFilePath) {

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 109)May include surrounding context.

md
import ora from "ora"

/**
 * Write or update an .env file with the provided key-value pairs.
 * Merges with existing content — preserves unrelated entries.
 */
export async function writeEnvFile(config, envFilePath) {

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 176)May include surrounding context.

md
import ora from "ora"

/**
 * Write or update an .env file with the provided key-value pairs.
 * Merges with existing content — preserves unrelated entries.
 */
export async function writeEnvFile(config, envFilePath) {

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 225)May include surrounding context.

md
import ora from "ora"

/**
 * Write or update an .env file with the provided key-value pairs.
 * Merges with existing content — preserves unrelated entries.
 */
export async function writeEnvFile(config, envFilePath) {

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/bootstrap.mjs (reported line 65)May include surrounding context.

js
import ora from "ora"

/**
 * Write or update an .env file with the provided key-value pairs.
 * Merges with existing content — preserves unrelated entries.
 */
export async function writeEnvFile(config, envFilePath) {

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/bootstrap.mjs (reported line 83)May include surrounding context.

js
import ora from "ora"

/**
 * Write or update an .env file with the provided key-value pairs.
 * Merges with existing content — preserves unrelated entries.
 */
export async function writeEnvFile(config, envFilePath) {

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/utils/env-writer.mjs (reported line 5)May include surrounding context.

js
import ora from "ora"

/**
 * Write or update an .env file with the provided key-value pairs.
 * Merges with existing content — preserves unrelated entries.
 */
export async function writeEnvFile(config, envFilePath) {

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tests/evals.json (reported line 15)May include surrounding context.

json
import ora from "ora"

/**
 * Write or update an .env file with the provided key-value pairs.
 * Merges with existing content — preserves unrelated entries.
 */
export async function writeEnvFile(config, envFilePath) {

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tests/evals.json (reported line 16)May include surrounding context.

json
import ora from "ora"

/**
 * Write or update an .env file with the provided key-value pairs.
 * Merges with existing content — preserves unrelated entries.
 */
export async function writeEnvFile(config, envFilePath) {

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tests/graders.json (reported line 9)May include surrounding context.

json
import ora from "ora"

/**
 * Write or update an .env file with the provided key-value pairs.
 * Merges with existing content — preserves unrelated entries.
 */
export async function writeEnvFile(config, envFilePath) {

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tests/graders.json (reported line 10)May include surrounding context.

json
import ora from "ora"

/**
 * Write or update an .env file with the provided key-value pairs.
 * Merges with existing content — preserves unrelated entries.
 */
export async function writeEnvFile(config, envFilePath) {

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 25)May include surrounding context.

md
* Merges with existing content — preserves unrelated entries.
 */
export async function writeEnvFile(config, envFilePath) {
  const spinner = ora("Writing .env").start()

  try {
    let content = ""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 29)May include surrounding context.

md
* Merges with existing content — preserves unrelated entries.
 */
export async function writeEnvFile(config, envFilePath) {
  const spinner = ora("Writing .env").start()

  try {
    let content = ""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/bootstrap.mjs (reported line 66)May include surrounding context.

js
* Merges with existing content — preserves unrelated entries.
 */
export async function writeEnvFile(config, envFilePath) {
  const spinner = ora("Writing .env").start()

  try {
    let content = ""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/utils/env-writer.mjs (reported line 9)May include surrounding context.

js
* Merges with existing content — preserves unrelated entries.
 */
export async function writeEnvFile(config, envFilePath) {
  const spinner = ora("Writing .env").start()

  try {
    let content = ""

Static analysis

No suspicious patterns detected.