ClawHub
Back to skill

Security audit

Auth0 Vue

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Auth0 Vue integration guide, but it includes copy-paste setup and token-handling examples that create meaningful security risk if followed as written.

Review before installing or using this skill. Prefer package-manager or pinned, verified Auth0 CLI installation steps; do not run the downloaded Linux installer automatically. When copying API examples, only attach access tokens to fixed trusted HTTPS API origins, avoid dumping full user objects in UI/logs, and keep SDK token storage in memory unless persistent sessions are an explicit, understood requirement.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
references/setup.md:49
Finding
Unpinned Remote Installer Is Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `references/setup.md`, lines 49–52 and 195–198 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -sSfL https://raw.githubusercontent.com/auth0/auth0-cli/main/install.sh -o /tmp/auth0-install.sh echo "⚠️ Review the install script at /tmp/auth0-install.sh before running" sh /tmp/auth0-install.sh -b /usr/local/bin rm /tmp/auth0-install.sh ``` The manual setup section repeats the behavior: ```bash curl -sSfL https://raw.githubusercontent.com/auth0/auth0-cli/main/install.sh -o /tmp/auth0-install.sh # Review the script before running: cat /tmp/auth0-install.sh sh /tmp/auth0-install.sh rm /tmp/auth0-install.sh ``` ### Technical Analysis The setup instructions download a shell script from the mutable `main` branch of an external repository and execute it without verifying a cryptographic checksum, digital signature, or pinned commit. The reviewed Skill therefore does not contain the effective installation payload; that payload can change after the Skill has been audited. The automated workflow displays a request to review the downloaded script but immediately executes it without pausing for explicit confirmation. Consequently, the message does not enforce a security boundary. The first command installs into `/usr/local/bin`, which is a system-wide location and may require elevated privileges. A system-wide installation exceeds the minimum permissions needed when a user-local installation would be sufficient. ### Attack Path 1. An attacker compromises the upstream repository, maintainer account, release infrastructure, or another part of the delivery path. 2. The attacker modifies `install.sh` on the referenced mutable `main` branch. 3. A user or agent follows the automated setup instructions. 4. `curl` retrieves the changed script without validating its expected digest or signature. 5. `sh` executes the attacker-controlled payload. 6. The p ...[truncated 886 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Prefer an official package manager or signed release artifact instead of executing a branch-hosted installation script. 2. Pin downloads to an immutable release version or full Git commit rather than `main`. 3. Verify a publisher-provided SHA-256 digest or cryptographic signature before execution, and fail closed when verification fails. 4. Separate download and execution into distinct user-approved steps. After download, pause and require explicit confirmation before running the script. 5. Default to a user-owned installation directory such as `$HOME/.local/bin`; request system-wide installation only when the user explicitly requires it. 6. Create temporary files securely with `mktemp`, apply restrictive permissions, and use a cleanup trap. 7. Avoid silent execution. Display the exact source, pinned version, expected digest, destination, and required privileges before proceeding. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
references/integration.md:221
Finding
Bearer Token Can Be Sent to an Arbitrary Caller-Controlled URL<![CDATA[ ## Vulnerability Details **File Location**: `references/integration.md`, lines 221–225 **Vulnerability Type**: Unrestricted sensitive-token forwarding **Risk Level**: High ### Vulnerable Code ```typescript const callProtectedApi = async (url: string) => { const token = await getAccessTokenSilently(); return fetch(url, { headers: { Authorization: `Bearer ${token}` } }); }; ``` ### Technical Analysis The helper accepts an unrestricted URL and unconditionally attaches an Auth0 bearer token to the request. It does not verify the destination scheme, hostname, port, path, or relationship between the token audience and the destination API. Bearer tokens grant access to anyone possessing them. If an attacker can influence the `url` argument through application state, remote content, query parameters, configuration, or another injection flaw, the browser will transmit the token to the attacker's endpoint. The fixed-placeholder API examples elsewhere in the documentation represent a legitimate and necessary use of access tokens. The vulnerability is specific to this generic helper because it removes the destination trust boundary. ### Attack Path 1. An application adopts the documented `callProtectedApi(url)` helper. 2. Untrusted input is allowed to influence the `url` argument, directly or indirectly. 3. An attacker supplies a destination such as `https://attacker.example/collect`. 4. The helper obtains a valid access token through `getAccessTokenSilently()`. 5. `fetch()` sends `Authorization: Bearer &lt;token&gt;` to the attacker-controlled server. 6. The attacker captures the token and attempts to replay it against the API for which it was issued. 7. Replay succeeds to the extent permitted by the token's audience, scopes, lifetime, and server-side validation. ### Impact Assessment The immediate impact is disclosure of an Auth0 access token. An attacker may impersonate the authenticated user to the protected API and perform operations autho ...[truncated 394 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Replace the arbitrary URL parameter with a fixed, trusted API base URL from controlled configuration. 2. If multiple destinations are required, enforce an exact allowlist of HTTPS origins, including scheme, hostname, and port. 3. Reject URLs containing user information, unexpected ports, non-HTTPS schemes, or unapproved origins. 4. Prevent authenticated requests from following redirects to untrusted origins, or validate every redirect destination before retaining the authorization header. 5. Request a token for the exact API audience and minimum required scopes. 6. Keep endpoint selection separate from credential attachment. Only a dedicated trusted API client should add the bearer token. 7. Ensure the API validates issuer, audience, signature, expiration, and authorization scopes on every request. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
references/integration.md:284
Finding
Refresh Tokens Are Persisted in JavaScript-Accessible Local Storage<![CDATA[ ## Vulnerability Details **File Location**: `references/integration.md`, lines 284–292; duplicated in `references/api.md`, lines 198–211 **Vulnerability Type**: Insecure persistent token storage **Risk Level**: Medium ### Vulnerable Code ```typescript app.use( createAuth0({ domain: import.meta.env.VITE_AUTH0_DOMAIN, clientId: import.meta.env.VITE_AUTH0_CLIENT_ID, cacheLocation: 'localstorage', // or 'memory' for stricter security useRefreshTokens: true }) ); ``` The API reference also presents the configuration as part of a complete example: ```typescript app.use( createAuth0({ domain: 'your-tenant.auth0.com', clientId: 'your-client-id', authorizationParams: { redirect_uri: window.location.origin, audience: 'https://your-api-identifier', scope: 'openid profile email', }, cacheLocation: 'localstorage', useRefreshTokens: true, }) ); ``` ### Technical Analysis `localStorage` is persistent and readable by JavaScript executing under the application's origin. Configuring the SDK to use local storage while enabling refresh tokens increases both the persistence and value of authentication material exposed to a same-origin script compromise. Any successful cross-site scripting vulnerability, compromised frontend dependency, malicious tag-manager payload, or other unauthorized same-origin script can attempt to access stored authentication data. The comments mention that memory is stricter, but the examples do not adequately explain the security implications and present local storage as a normal persistence option. This configuration is not necessary for the Skill's core login and API-call functionality because the SDK's default in-memory cache provides a narrower exposure window. ### Attack Path 1. A developer copies the documented configuration into a Vue application. 2. Authentication material is persisted in browser local storage to maintain sessions. 3. The application later develops ...[truncated 912 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Use the SDK's default in-memory cache unless persistent sessions are an explicit requirement. 2. Change the primary examples to `cacheLocation: 'memory'` or omit `cacheLocation` entirely. 3. Place the local-storage option in a clearly marked risk section rather than in the complete recommended configuration. 4. If persistent refresh tokens are required, enable refresh-token rotation and reuse detection in Auth0. 5. Minimize token scopes, audiences, and lifetimes. 6. Enforce a restrictive Content Security Policy, avoid unsafe inline execution, and tightly control third-party scripts and frontend dependencies. 7. Apply robust output encoding and input handling to prevent XSS throughout the application. 8. Document incident-response procedures for revoking sessions and refresh tokens after a client-side compromise. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (19)

Credential Access

High
Category
Privilege Escalation
Content
- `user` - Reactive user profile information
- `loginWithRedirect()` - Initiate login
- `logout()` - Log out user
- `getAccessTokenSilently()` - Get access token for API calls

**Common Use Cases:**
- Login/Logout buttons → See Step 4 above
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Hidden Instructions

High
Category
Prompt Injection
Content
<template>
  <div v-if="isAuthenticated">
    <!-- Protected content -->
  </div>
</template>
```
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Credential Access

High
Category
Privilege Escalation
Content
## Calling APIs

### API Call with Access Token

```vue
<script setup lang="ts">
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
4. **API Calls**
   - Call protected API endpoint
   - Verify access token is included
   - Verify API responds correctly

---
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
**Before running any part of this setup that writes to `.env`, you MUST ask the user for explicit confirmation.** Follow the steps below precisely.

### Step 1: Check for existing .env and confirm with user

Before writing to `.env`, check whether the file already exists:
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
**Before running any part of this setup that writes to `.env`, you MUST ask the user for explicit confirmation.** Follow the steps below precisely.

### Step 1: Check for existing .env and confirm with user

Before writing to `.env`, check whether the file already exists:
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
**Before running any part of this setup that writes to `.env`, you MUST ask the user for explicit confirmation.** Follow the steps below precisely.

### Step 1: Check for existing .env and confirm with user

Before writing to `.env`, check whether the file already exists:
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
**Before running any part of this setup that writes to `.env`, you MUST ask the user for explicit confirmation.** Follow the steps below precisely.

### Step 1: Check for existing .env and confirm with user

Before writing to `.env`, check whether the file already exists:
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
**Before running any part of this setup that writes to `.env`, you MUST ask the user for explicit confirmation.** Follow the steps below precisely.

### Step 1: Check for existing .env and confirm with user

Before writing to `.env`, check whether the file already exists:
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
**Before running any part of this setup that writes to `.env`, you MUST ask the user for explicit confirmation.** Follow the steps below precisely.

### Step 1: Check for existing .env and confirm with user

Before writing to `.env`, check whether the file already exists:
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
**Before running any part of this setup that writes to `.env`, you MUST ask the user for explicit confirmation.** Follow the steps below precisely.

### Step 1: Check for existing .env and confirm with user

Before writing to `.env`, check whether the file already exists:
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
**Before running any part of this setup that writes to `.env`, you MUST ask the user for explicit confirmation.** Follow the steps below precisely.

### Step 1: Check for existing .env and confirm with user

Before writing to `.env`, check whether the file already exists:
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
- If `.env` does **not** exist, ask:
  - Question: "This setup will create a `.env` file containing Auth0 credentials (domain and client ID). Do you want to proceed?"
  - Options: "Yes, create .env" / "No, I'll configure it manually"

- If `.env` **already exists**, ask:
  - Question: "A `.env` file already exists and may contain secrets unrelated to Auth0. This setup will append Auth0 credentials to it without modifying existing content. Do you want to proceed?"
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
- If `.env` does **not** exist, ask:
  - Question: "This setup will create a `.env` file containing Auth0 credentials (domain and client ID). Do you want to proceed?"
  - Options: "Yes, create .env" / "No, I'll configure it manually"

- If `.env` **already exists**, ask:
  - Question: "A `.env` file already exists and may contain secrets unrelated to Auth0. This setup will append Auth0 credentials to it without modifying existing content. Do you want to proceed?"
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
curl -sSfL https://raw.githubusercontent.com/auth0/auth0-cli/main/install.sh -o /tmp/auth0-install.sh
    echo "⚠️  Review the install script at /tmp/auth0-install.sh before running"
    sh /tmp/auth0-install.sh -b /usr/local/bin
    rm /tmp/auth0-install.sh
  fi
fi
Confidence
85% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
curl -sSfL https://raw.githubusercontent.com/auth0/auth0-cli/main/install.sh -o /tmp/auth0-install.sh
    echo "⚠️  Review the install script at /tmp/auth0-install.sh before running"
    sh /tmp/auth0-install.sh -b /usr/local/bin
    rm /tmp/auth0-install.sh
  fi
fi
Confidence
85% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The example renders the full Auth0 user object with JSON.stringify, which can expose more profile attributes than intended in the browser UI, screenshots, logs, or shared sessions. In an authentication integration guide, this is especially risky because developers may copy the snippet directly into production and inadvertently disclose sensitive identity data.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The guide explicitly tells the user to review the downloaded Linux install script before executing it, but the automated Bash path immediately runs that remote-fetched script anyway. This creates a supply-chain risk: if the script source is compromised or the transport/path is abused, arbitrary code will run locally with the user's privileges without the promised review step occurring.

Missing User Warnings

Low
Confidence
85% confidence
Finding
This markdown file includes an example that retrieves an access token and sends it in an Authorization header to `https://your-api.com/data`. While the behavior is expected for an API-calling example, the surrounding description does not explicitly warn that user/session credentials will be transmitted to a backend service.

Static analysis

No suspicious patterns detected.