Security audit

Auth0 Swift

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its Auth0 Swift setup purpose, but it includes unsafe installation guidance and examples that can leak access tokens into logs.

Review this before installing. Only run the bootstrap against the intended Xcode project and Auth0 tenant, avoid the curl-to-shell installer path, prefer pinned dependencies or a reviewed lockfile, and remove any code that logs access tokens, refresh tokens, ID tokens, passwords, MFA tokens, or authorization headers.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/utils/validation.mjs:27
Finding: Unverified Remote Installer Piped Directly into a Shell
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/integration.md:45
Finding: OAuth Access Tokens Exposed in Application Logs
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/package.json:6
Finding: Unpinned Runtime Dependencies Create Supply-Chain Exposure
Content: View full analysis
/auth0-swift/scripts npm install node bootstrap.mjs ``` ```javascript async function ensureXcodeprojGem() { try { await $`ruby -e "require 'xcodeproj'"` return true } catch { const installSpinner = ora("Installing xcodeproj gem").start() try { await $({ timeout: 120000 })`gem install xcodeproj --quiet` installSpinner.succeed("xcodeproj gem installed") return true ``` ### Technical Analysis The repository does not include an npm lockfile, while its dependency declarations use caret ranges. Consequently, `npm install` can resolve different direct or transitive package versions at different times. The Ruby helper also installs `xcodeproj` without specifying a version. Both npm packages and Ruby gems can execute installation or runtime code with the user's privileges. Mutable resolution makes the effective dependency set difficult to reproduce or audit. No evidence was found that the named packages are currently malicious. The vulnerability is the unsafe dependency-resolution and installation process rather than confirmed malicious package content. ### Attack Path 1. The agent follows the setup guide and runs `npm install`, or the bootstrap detects a missing `xcodeproj` gem. 2. The package manager resolves versions from a public registry without a repository-provided lockfile or exact Ruby gem version. 3. A compromised release, maintainer account, registry entry, or transitive dependency is selected. 4. Package installation or later imp ...[truncated 564 chars]
Remediation: View remediation
`. - Prefer a committed `Gemfile` and `Gemfile.lock`, then invoke the helper through Bundler. - Review dependency integrity metadata and registry provenance during updates. - Disable unnecessary lifecycle scripts where compatible with required packages. - Use automated dependency scanning and require review for lockfile changes. ]]>

T09 · Insecure Skill Coding Practices

Note

Location: scripts/utils/validation.mjs:74
Finding: Out-of-Scope Variable Causes Bootstrap Validation Failure
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (137)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is about integrating Auth0 authentication into native Apple apps via Auth0.swift features such as Web Auth and biometric credential protection. The supplied code does none of that. Instead, it is a TypeScript utility for test/evaluation infrastructure that reads a JSON file and converts grader definitions between formats. Its primary purpose, language/ecosystem, and behavior are materially unrelated to iOS/macOS/tvOS/watchOS/visionOS authentication integration, so this is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.
md
ocoaPods or Carthage:** Follow the matching installation steps in [Setup Guide](./references/setup.md#sdk-installation). Do not just show the instructions — per

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.
md
ocoaPods or Carthage:** Follow the matching installation steps in [Setup Guide](./references/setup.md#sdk-installation). Do not just show the instructions — per

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.
md
ocoaPods or Carthage:** Follow the matching installation steps in [Setup Guide](./references/setup.md#sdk-installation). Do not just show the instructions — per

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.
md
ocoaPods or Carthage:** Follow the matching installation steps in [Setup Guide](./references/setup.md#sdk-installation). Do not just show the instructions — per

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 239)May include surrounding context.
md
ocoaPods or Carthage:** Follow the matching installation steps in [Setup Guide](./references/setup.md#sdk-installation). Do not just show the instructions — per

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 241)May include surrounding context.
md
- **[API Reference & Testing](./references/api.md)** — Full API reference, configuration options, claims reference, testing checklist, troubleshooting

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/api.md (reported line 40)May include surrounding context.
md
|--------|------|-------------| | `.useHTTPS()` | — | Use Universal Links (HTTPS) for callback — recommended | | `.scope(_ scope: String)` | `String` | Space-separated OAuth scopes. Default: `"openid profile email"`. Add `"offline_access"` for refresh tokens | | `.audience(_ audience: String)` | `String` | API audience (resource identifier). Required for API access tokens | | `.parameters(_ params: [String: String])` | `[String: String]` | Additional authorize parameters (e.g., `["screen_hint": "signup"]`) | | `.organization(_ organization: String)` | `String` | Auth0 Organization ID or name | | `.invitationURL(_ url: URL)` | `URL` | Accept an organization invitation |

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/api.md (reported line 62)May include surrounding context.
md
| `.credentials()` | `Credentials` (async) | Retrieve valid credentials; auto-renews if expired | | `.credentials(minTTL:)` | `Credentials` (async) | Retrieve with minimum remaining TTL | | `.canRenew()` | `Bool` | Returns `true` if a refresh token is available | | `.hasValid(minTTL:)` | `Bool` | Returns `true` if access token is valid for at least `minTTL` seconds | | `.clear()` | `Bool` | Remove credentials from Keychain | | `.revoke(headers:)` | `Void` (async) | Revoke refresh token and clear credentials | | `.enableBiometrics(withTitle:)` | — | Prompt biometric authentication when retrieving credentials |

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/api.md (reported line 83)May include surrounding context.
md
| `.credentials()` | `Credentials` (async) | Retrieve valid credentials; auto-renews if expired | | `.credentials(minTTL:)` | `Credentials` (async) | Retrieve with minimum remaining TTL | | `.canRenew()` | `Bool` | Returns `true` if a refresh token is available | | `.hasValid(minTTL:)` | `Bool` | Returns `true` if access token is valid for at least `minTTL` seconds | | `.clear()` | `Bool` | Remove credentials from Keychain | | `.revoke(headers:)` | `Void` (async) | Revoke refresh token and clear credentials | | `.enableBiometrics(withTitle:)` | — | Prompt biometric authentication when retrieving credentials |

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/api.md (reported line 147)May include surrounding context.
md
| `.credentials()` | `Credentials` (async) | Retrieve valid credentials; auto-renews if expired | | `.credentials(minTTL:)` | `Credentials` (async) | Retrieve with minimum remaining TTL | | `.canRenew()` | `Bool` | Returns `true` if a refresh token is available | | `.hasValid(minTTL:)` | `Bool` | Returns `true` if access token is valid for at least `minTTL` seconds | | `.clear()` | `Bool` | Remove credentials from Keychain | | `.revoke(headers:)` | `Void` (async) | Revoke refresh token and clear credentials | | `.enableBiometrics(withTitle:)` | — | Prompt biometric authentication when retrieving credentials |

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/api.md (reported line 181)May include surrounding context.
md
| `.credentials()` | `Credentials` (async) | Retrieve valid credentials; auto-renews if expired | | `.credentials(minTTL:)` | `Credentials` (async) | Retrieve with minimum remaining TTL | | `.canRenew()` | `Bool` | Returns `true` if a refresh token is available | | `.hasValid(minTTL:)` | `Bool` | Returns `true` if access token is valid for at least `minTTL` seconds | | `.clear()` | `Bool` | Remove credentials from Keychain | | `.revoke(headers:)` | `Void` (async) | Revoke refresh token and clear credentials | | `.enableBiometrics(withTitle:)` | — | Prompt biometric authentication when retrieving credentials |

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/integration.md (reported line 83)May include surrounding context.
md
| `.credentials()` | `Credentials` (async) | Retrieve valid credentials; auto-renews if expired | | `.credentials(minTTL:)` | `Credentials` (async) | Retrieve with minimum remaining TTL | | `.canRenew()` | `Bool` | Returns `true` if a refresh token is available | | `.hasValid(minTTL:)` | `Bool` | Returns `true` if access token is valid for at least `minTTL` seconds | | `.clear()` | `Bool` | Remove credentials from Keychain | | `.revoke(headers:)` | `Void` (async) | Revoke refresh token and clear credentials | | `.enableBiometrics(withTitle:)` | — | Prompt biometric authentication when retrieving credentials |

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/integration.md (reported line 150)May include surrounding context.
md
| `.credentials()` | `Credentials` (async) | Retrieve valid credentials; auto-renews if expired | | `.credentials(minTTL:)` | `Credentials` (async) | Retrieve with minimum remaining TTL | | `.canRenew()` | `Bool` | Returns `true` if a refresh token is available | | `.hasValid(minTTL:)` | `Bool` | Returns `true` if access token is valid for at least `minTTL` seconds | | `.clear()` | `Bool` | Remove credentials from Keychain | | `.revoke(headers:)` | `Void` (async) | Revoke refresh token and clear credentials | | `.enableBiometrics(withTitle:)` | — | Prompt biometric authentication when retrieving credentials |

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/api.md (reported line 87)May include surrounding context.
md
| `tokenType` | `String` | Token type, usually `"Bearer"` | | `idToken` | `String` | JWT ID token with user identity claims | | `refreshToken` | `String?` | Refresh token (requires `offline_access` scope) | | `expiresIn` | `Date` | Access token expiration date | | `scope` | `String?` | Granted scopes | ---

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/integration.md (reported line 121)May include surrounding context.
swift
let credentials = try await Auth0.webAuth().start() guard credentialsManager.store(credentials: credentials) else { throw AuthError.keychainWriteFailed }

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/integration.md (reported line 450)May include surrounding context.

Calling Your API with the Access Token

swift
func fetchData() async throws -> [Item] {

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/setup.md (reported line 215)May include surrounding context.
md
Auth0.swift **does not use a client secret**. Native apps use PKCE (Proof Key for Code Exchange), which is secure without a secret. - `ClientId` and `Domain` in `Auth0.plist` are **not secrets** — they are safe to commit to source control - Access tokens and refresh tokens are stored in the iOS/macOS **Keychain** by `CredentialsManager` — never in `UserDefaults` or plain files - No environment variables or `.env` files are needed for the Auth0 configuration ---

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 251)May include surrounding context.
md
{ "id": 1, "prompt": "Add Auth0 authentication to a Swift iOS application using the Auth0.swift SDK.\n\n**Auth0 Credentials:**\n- Domain: `dev-example.auth0.com`\n- Client ID: `abc123def456ghi789jkl012`", "expected_output": "Working iOS Swift app with Auth0 Web Auth login, secure Keychain credential storage via CredentialsManager, and proper Auth0.plist configuration", "expectations": [ "Auth0 SDK installed via any valid method (SPM URL, CocoaPods pod line, or Carthage)", "Has correct import statement (import Auth0)",

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/api.md (reported line 58)May include surrounding context.
md
{ "id": 1, "prompt": "Add Auth0 authentication to a Swift iOS application using the Auth0.swift SDK.\n\n**Auth0 Credentials:**\n- Domain: `dev-example.auth0.com`\n- Client ID: `abc123def456ghi789jkl012`", "expected_output": "Working iOS Swift app with Auth0 Web Auth login, secure Keychain credential storage via CredentialsManager, and proper Auth0.plist configuration", "expectations": [ "Auth0 SDK installed via any valid method (SPM URL, CocoaPods pod line, or Carthage)", "Has correct import statement (import Auth0)",

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/api.md (reported line 63)May include surrounding context.
md
{ "id": 1, "prompt": "Add Auth0 authentication to a Swift iOS application using the Auth0.swift SDK.\n\n**Auth0 Credentials:**\n- Domain: `dev-example.auth0.com`\n- Client ID: `abc123def456ghi789jkl012`", "expected_output": "Working iOS Swift app with Auth0 Web Auth login, secure Keychain credential storage via CredentialsManager, and proper Auth0.plist configuration", "expectations": [ "Auth0 SDK installed via any valid method (SPM URL, CocoaPods pod line, or Carthage)", "Has correct import statement (import Auth0)",

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/api.md (reported line 139)May include surrounding context.
md
{ "id": 1, "prompt": "Add Auth0 authentication to a Swift iOS application using the Auth0.swift SDK.\n\n**Auth0 Credentials:**\n- Domain: `dev-example.auth0.com`\n- Client ID: `abc123def456ghi789jkl012`", "expected_output": "Working iOS Swift app with Auth0 Web Auth login, secure Keychain credential storage via CredentialsManager, and proper Auth0.plist configuration", "expectations": [ "Auth0 SDK installed via any valid method (SPM URL, CocoaPods pod line, or Carthage)", "Has correct import statement (import Auth0)",

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/integration.md (reported line 18)May include surrounding context.
md
{ "id": 1, "prompt": "Add Auth0 authentication to a Swift iOS application using the Auth0.swift SDK.\n\n**Auth0 Credentials:**\n- Domain: `dev-example.auth0.com`\n- Client ID: `abc123def456ghi789jkl012`", "expected_output": "Working iOS Swift app with Auth0 Web Auth login, secure Keychain credential storage via CredentialsManager, and proper Auth0.plist configuration", "expectations": [ "Auth0 SDK installed via any valid method (SPM URL, CocoaPods pod line, or Carthage)", "Has correct import statement (import Auth0)",

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/integration.md (reported line 268)May include surrounding context.
md
{ "id": 1, "prompt": "Add Auth0 authentication to a Swift iOS application using the Auth0.swift SDK.\n\n**Auth0 Credentials:**\n- Domain: `dev-example.auth0.com`\n- Client ID: `abc123def456ghi789jkl012`", "expected_output": "Working iOS Swift app with Auth0 Web Auth login, secure Keychain credential storage via CredentialsManager, and proper Auth0.plist configuration", "expectations": [ "Auth0 SDK installed via any valid method (SPM URL, CocoaPods pod line, or Carthage)", "Has correct import statement (import Auth0)",

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/integration.md (reported line 269)May include surrounding context.
md
{ "id": 1, "prompt": "Add Auth0 authentication to a Swift iOS application using the Auth0.swift SDK.\n\n**Auth0 Credentials:**\n- Domain: `dev-example.auth0.com`\n- Client ID: `abc123def456ghi789jkl012`", "expected_output": "Working iOS Swift app with Auth0 Web Auth login, secure Keychain credential storage via CredentialsManager, and proper Auth0.plist configuration", "expectations": [ "Auth0 SDK installed via any valid method (SPM URL, CocoaPods pod line, or Carthage)", "Has correct import statement (import Auth0)",

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

SkillSpector

Tp4

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Calling Your API with the Access Token

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Static analysis