Auth0 Swift Major Migration

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:49 AM UTC
• Version: 1.0.0

Overview

The migration skill itself is mostly coherent, but its bundled evaluation runner can copy broad project contents, include sensitive files, and send source snippets to an external Claude CLI without clear informed consent.

The core migration instructions look usable for an Auth0.swift upgrade, but do not run the bundled eval script on a real or sensitive project unless you first remove secrets, exclude .env and credential-bearing config files, and are comfortable sending source snippets to the configured Claude provider. Prefer running the skill only on a clean git worktree and review all generated changes before committing.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: tests/run-evals.mjs:241

Finding

Project source and secret-bearing files may be transmitted to an external model without explicit disclosure consent

Content

View full analysis

`--- ${path.relative(workspaceDir, s.path)} ---\n${s.content.slice(0, 3000)}`) .join("\n\n") // Build judge prompt — include examples if provided (few-shot) let questionBlock = grader.question if (grader.examples) { questionBlock += `\n\n## Examples\n${grader.examples}` } const judgePrompt = `You are evaluating code quality. Review the following source files and answer this question: ${questionBlock} Answer with exactly "YES" or "NO" on the first line, followed by a brief explanation. ${fileSummary}` ``` ```js try { const { stdout } = await $({ timeout: 60000, })`claude ${judgeArgs}` ``` Tool-enabled agent runs are executed non-interactively with broad capabilities: ```js async function runClaude(taskPrompt, workspaceDir, systemPrompt = null) { const args = [ "-p", taskPrompt, "--permission-mode", "dontAsk", "--no-session- ...[truncated 4458 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (48)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is about an Auth0.swift v2→v3 migration skill for Apple app codebases. The supplied code is unrelated: it is a TypeScript utility in tests/graders.ts that parses graders.json and converts grader specifications into another internal format. Its inputs, outputs, language, and purpose all differ materially from the declared behavior. This is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 1192)May include surrounding context.

}

text

For most apps the new default is preferable — renewing tokens slightly before expiry avoids races where an in-flight request uses an access token that expires mid-request. Only set `minTTL: 0` explicitly if the app has a specific reason to renew only at exact expiry.

Surface this as a **behavioural note** in the Step 9 summary.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 733)May include surrounding context.

2. Secure Token Storage

plaintext

[ ] Credentials stored in Keychain via CredentialsManager (not UserDefaults, not files)
[ ] No tokens stored in plain text anywhere
[ ] Biometric protection preserved if it existed before migration

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 760)May include surrounding context.

2. Secure Token Storage

plaintext

[ ] Credentials stored in Keychain via CredentialsManager (not UserDefaults, not files)
[ ] No tokens stored in plain text anywhere
[ ] Biometric protection preserved if it existed before migration

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 776)May include surrounding context.

2. Secure Token Storage

plaintext

[ ] Credentials stored in Keychain via CredentialsManager (not UserDefaults, not files)
[ ] No tokens stored in plain text anywhere
[ ] Biometric protection preserved if it existed before migration

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 866)May include surrounding context.

2. Secure Token Storage

plaintext

[ ] Credentials stored in Keychain via CredentialsManager (not UserDefaults, not files)
[ ] No tokens stored in plain text anywhere
[ ] Biometric protection preserved if it existed before migration

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 868)May include surrounding context.

2. Secure Token Storage

plaintext

[ ] Credentials stored in Keychain via CredentialsManager (not UserDefaults, not files)
[ ] No tokens stored in plain text anywhere
[ ] Biometric protection preserved if it existed before migration

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 872)May include surrounding context.

2. Secure Token Storage

plaintext

[ ] Credentials stored in Keychain via CredentialsManager (not UserDefaults, not files)
[ ] No tokens stored in plain text anywhere
[ ] Biometric protection preserved if it existed before migration

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 876)May include surrounding context.

2. Secure Token Storage

plaintext

[ ] Credentials stored in Keychain via CredentialsManager (not UserDefaults, not files)
[ ] No tokens stored in plain text anywhere
[ ] Biometric protection preserved if it existed before migration

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 881)May include surrounding context.

2. Secure Token Storage

plaintext

[ ] Credentials stored in Keychain via CredentialsManager (not UserDefaults, not files)
[ ] No tokens stored in plain text anywhere
[ ] Biometric protection preserved if it existed before migration

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 883)May include surrounding context.

2. Secure Token Storage

plaintext

[ ] Credentials stored in Keychain via CredentialsManager (not UserDefaults, not files)
[ ] No tokens stored in plain text anywhere
[ ] Biometric protection preserved if it existed before migration

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 890)May include surrounding context.

2. Secure Token Storage

plaintext

[ ] Credentials stored in Keychain via CredentialsManager (not UserDefaults, not files)
[ ] No tokens stored in plain text anywhere
[ ] Biometric protection preserved if it existed before migration

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 896)May include surrounding context.

2. Secure Token Storage

plaintext

[ ] Credentials stored in Keychain via CredentialsManager (not UserDefaults, not files)
[ ] No tokens stored in plain text anywhere
[ ] Biometric protection preserved if it existed before migration

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 902)May include surrounding context.

2. Secure Token Storage

plaintext

[ ] Credentials stored in Keychain via CredentialsManager (not UserDefaults, not files)
[ ] No tokens stored in plain text anywhere
[ ] Biometric protection preserved if it existed before migration

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 1270)May include surrounding context.

2. Secure Token Storage

plaintext

[ ] Credentials stored in Keychain via CredentialsManager (not UserDefaults, not files)
[ ] No tokens stored in plain text anywhere
[ ] Biometric protection preserved if it existed before migration

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/security.md (reported line 28)May include surrounding context.

2. Secure Token Storage

plaintext

[ ] Credentials stored in Keychain via CredentialsManager (not UserDefaults, not files)
[ ] No tokens stored in plain text anywhere
[ ] Biometric protection preserved if it existed before migration

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/security.md (reported line 50)May include surrounding context.

2. Secure Token Storage

plaintext

[ ] Credentials stored in Keychain via CredentialsManager (not UserDefaults, not files)
[ ] No tokens stored in plain text anywhere
[ ] Biometric protection preserved if it existed before migration

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/security.md (reported line 71)May include surrounding context.

md

If login/logout method signatures change:

- Verify the same scopes are still requested (especially `offline_access` for refresh tokens)
- Verify the same audience is still passed (for API access tokens)
- Verify redirect URIs still match what's configured in Auth0 Dashboard

### When Error Handling Changes

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tests/run-evals.mjs (reported line 51)May include surrounding context.

js

".swift", ".kt", ".java", ".cs", ".go", ".py", ".rb", ".php", ".dart",
  ".vue", ".svelte", ".astro",
  ".gradle", ".kts",
  ".xml", ".plist", ".json", ".env", ".yaml", ".yml", ".toml", ".properties",
  ".html", ".css", ".scss",
  ".csproj", ".sln",
  ".lock",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tests/run-evals.mjs (reported line 378)May include surrounding context.

js

".swift", ".kt", ".java", ".cs", ".go", ".py", ".rb", ".php", ".dart",
  ".vue", ".svelte", ".astro",
  ".gradle", ".kts",
  ".xml", ".plist", ".json", ".env", ".yaml", ".yml", ".toml", ".properties",
  ".html", ".css", ".scss",
  ".csproj", ".sln",
  ".lock",

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The runner launches claude with --allowedTools Bash,Read,Write,Edit,Glob,Grep,WebFetch, giving the agent shell execution plus network and filesystem mutation over the copied workspace. For a migration skill, arbitrary Bash is excessive and can be used to inspect secrets, alter unrelated files, invoke other binaries, or exfiltrate data via command-line tooling.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

bash

# Use the tag the developer chose in Step 2.
# If no tag was specified, resolve the latest v3 release (stable or pre-release):
TAG=$(curl -s https://api.github.com/repos/auth0/Auth0.swift/releases | python3 -c "
import sys, json
releases = json.load(sys.stdin)
v3 = [r for r in releases if r['tag_name'].startswith('3') and not r['draft']]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

bash

# Use the tag the developer chose in Step 2.
# If no tag was specified, resolve the latest v3 release (stable or pre-release):
TAG=$(curl -s https://api.github.com/repos/auth0/Auth0.swift/releases | python3 -c "
import sys, json
releases = json.load(sys.stdin)
v3 = [r for r in releases if r['tag_name'].startswith('3') and not r['draft']]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

bash

# Use the tag the developer chose in Step 2.
# If no tag was specified, resolve the latest v3 release (stable or pre-release):
TAG=$(curl -s https://api.github.com/repos/auth0/Auth0.swift/releases | python3 -c "
import sys, json
releases = json.load(sys.stdin)
v3 = [r for r in releases if r['tag_name'].startswith('3') and not r['draft']]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/process.md (reported line 33)May include surrounding context.

bash

# Use the tag the developer chose in Step 2.
# If no tag was specified, resolve the latest v3 release (stable or pre-release):
TAG=$(curl -s https://api.github.com/repos/auth0/Auth0.swift/releases | python3 -c "
import sys, json
releases = json.load(sys.stdin)
v3 = [r for r in releases if r['tag_name'].startswith('3') and not r['draft']]

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:459