ClawHub
Back to skill

Security audit

Auth0 Swift Major Migration

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent Auth0.swift v2-to-v3 migration helper with disclosed, purpose-aligned project edits and no evidence of hidden collection or destructive behavior.

Install only for projects where you intend to migrate Auth0.swift v2 to v3. Expect it to edit dependencies and Swift source, run builds/tests, and fetch public Auth0 SDK files from GitHub. Review the final diff and avoid pasting terminal output that could include project-specific secrets if security grep commands find any.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The skill instructs the agent to fetch remote SDK source and echo the full contents to terminal output. While the source itself is public, indiscriminately printing large remote content into logs increases data exposure risk, can leak neighboring context if commands are modified, and creates unnecessary unreviewed output in agent transcripts.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal