Security audit
Security checks for vulnerabilities and agentic risk
This appears to be a legitimate Auth0 JWT setup skill, but its automatic setup path can install mutable npm code and create Auth0 tenant resources using the user's existing CLI login.
Install only if you are comfortable with the automatic setup using your Auth0 CLI login to create an API resource and edit the target project's .env file. Prefer manual setup, or review the bootstrap change plan carefully, pin or lock npm dependencies, avoid curl-to-sh installers, and never paste production client secrets directly into shell commands.
scripts/utils/validation.mjs:21Unpinned Remote Installation Script Piped Directly to a Shell
references/setup.md:24Bootstrap Installation Uses Mutable, Unlocked npm Dependencies
references/api.md:180M2M Client Secret Embedded in Interactive Shell Commands
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Node OAuth2 JWT Bearer Integration
The `express-oauth2-jwt-bearer` package provides Express middleware for validating Auth0 JWT Bearer access tokens. It handles token extraction, signature verification, audience and issuer validation, and expiry checks per RFC 6750 — letting you focus on business logic rather than JWT parsing.
> **Agent instruction:** Before providing SDK setup instructions, fetch the latest release version by running:
> ```bash
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- **CORS before auth.** Always register `cors()` before `auth()`. Auth middleware rejects OPTIONS preflight requests with 401 if CORS isn't set first.
- **Audience validation is critical.** Without a matching `audience`, your API would accept tokens issued for other services.
- **Issuer validation.** The `issuerBaseURL` is used to fetch the JWKS and validate the `iss` claim. Never disable issuer validation in production.
- **RBAC via `permissions` claim.** Auth0 RBAC stores user permissions in the `permissions` JWT claim (not `scope`). Enable "Add Permissions in the Access Token" on your Auth0 API settings.
- **DPoP.** For APIs requiring sender-constrained tokens, enable DPoP with `dpop: { enabled: true, required: true }`. This prevents token theft — stolen tokens cannot be replayed without the original private key.
- **Helmet.** Pair with `helmet` for security headers: `npm install helmet` + `app.use(helmet())`.
- **Production secrets.** Never commit `.env` to source control. Use environment variables in production (Railway, Heroku, Fly.io, etc.).
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Client → API
1. Client obtains access token from Auth0 (via /oauth/token)
2. Client sends request with "Authorization: Bearer <token>" header
3. express-oauth2-jwt-bearer middleware:
a. Extracts bearer token from Authorization header
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Client → API
1. Client obtains access token from Auth0 (via /oauth/token)
2. Client sends request with "Authorization: Bearer <token>" header
3. express-oauth2-jwt-bearer middleware:
a. Extracts bearer token from Authorization header
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Use requiredScopes() to enforce scopes on access tokens:
import { auth, requiredScopes } from 'express-oauth2-jwt-bearer';
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
> **Agent instruction:**
>
> **Check if credentials are already provided in the user's prompt:** If the user's prompt already includes Auth0 Domain and API Audience (e.g. `your-tenant.us.auth0.com` and `https://api.example.com`), use them directly — skip to "Write the .env file" below. Do NOT call `AskUserQuestion` to re-confirm provided credentials, and do NOT run the bootstrap script.
>
> If credentials are NOT provided, offer setup choices:
>
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
> **Agent instruction:**
>
> **Check if credentials are already provided in the user's prompt:** If the user's prompt already includes Auth0 Domain and API Audience (e.g. `your-tenant.us.auth0.com` and `https://api.example.com`), use them directly — skip to "Write the .env file" below. Do NOT call `AskUserQuestion` to re-confirm provided credentials, and do NOT run the bootstrap script.
>
> If credentials are NOT provided, offer setup choices:
>
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
> **Agent instruction:**
>
> **Check if credentials are already provided in the user's prompt:** If the user's prompt already includes Auth0 Domain and API Audience (e.g. `your-tenant.us.auth0.com` and `https://api.example.com`), use them directly — skip to "Write the .env file" below. Do NOT call `AskUserQuestion` to re-confirm provided credentials, and do NOT run the bootstrap script.
>
> If credentials are NOT provided, offer setup choices:
>
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
> **Agent instruction:**
>
> **Check if credentials are already provided in the user's prompt:** If the user's prompt already includes Auth0 Domain and API Audience (e.g. `your-tenant.us.auth0.com` and `https://api.example.com`), use them directly — skip to "Write the .env file" below. Do NOT call `AskUserQuestion` to re-confirm provided credentials, and do NOT run the bootstrap script.
>
> If credentials are NOT provided, offer setup choices:
>
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
> **Agent instruction:**
>
> **Check if credentials are already provided in the user's prompt:** If the user's prompt already includes Auth0 Domain and API Audience (e.g. `your-tenant.us.auth0.com` and `https://api.example.com`), use them directly — skip to "Write the .env file" below. Do NOT call `AskUserQuestion` to re-confirm provided credentials, and do NOT run the bootstrap script.
>
> If credentials are NOT provided, offer setup choices:
>
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
> **Agent instruction:**
>
> **Check if credentials are already provided in the user's prompt:** If the user's prompt already includes Auth0 Domain and API Audience (e.g. `your-tenant.us.auth0.com` and `https://api.example.com`), use them directly — skip to "Write the .env file" below. Do NOT call `AskUserQuestion` to re-confirm provided credentials, and do NOT run the bootstrap script.
>
> If credentials are NOT provided, offer setup choices:
>
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
> **Agent instruction:**
>
> **Check if credentials are already provided in the user's prompt:** If the user's prompt already includes Auth0 Domain and API Audience (e.g. `your-tenant.us.auth0.com` and `https://api.example.com`), use them directly — skip to "Write the .env file" below. Do NOT call `AskUserQuestion` to re-confirm provided credentials, and do NOT run the bootstrap script.
>
> If credentials are NOT provided, offer setup choices:
>
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
> **Agent instruction:**
>
> **Check if credentials are already provided in the user's prompt:** If the user's prompt already includes Auth0 Domain and API Audience (e.g. `your-tenant.us.auth0.com` and `https://api.example.com`), use them directly — skip to "Write the .env file" below. Do NOT call `AskUserQuestion` to re-confirm provided credentials, and do NOT run the bootstrap script.
>
> If credentials are NOT provided, offer setup choices:
>
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
> **Agent instruction:**
>
> **Check if credentials are already provided in the user's prompt:** If the user's prompt already includes Auth0 Domain and API Audience (e.g. `your-tenant.us.auth0.com` and `https://api.example.com`), use them directly — skip to "Write the .env file" below. Do NOT call `AskUserQuestion` to re-confirm provided credentials, and do NOT run the bootstrap script.
>
> If credentials are NOT provided, offer setup choices:
>
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
1. Go to Auth0 Dashboard → APIs → your API → Settings
2. Enable **"Enable RBAC"**
3. Enable **"Add Permissions in the Access Token"**
4. Add permissions under the **Permissions** tab
5. Assign permissions to roles, and roles to users via Auth0 Dashboard
The file performs Auth0 tenant provisioning by invoking auth0 apis create, which is materially different from the declared purpose of adding JWT validation to an Express/Node.js API. In an agent-skill context, this expands capabilities from local code integration to external administrative changes against a tenant, creating risk of unauthorized resource creation, configuration drift, or abuse if the skill is triggered in environments with privileged Auth0 CLI credentials.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
import ora from "ora"
export async function writeEnvFile(config, envFilePath) {
const spinner = ora("Writing .env").start()
try {
let content = ""
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
import ora from "ora"
export async function writeEnvFile(config, envFilePath) {
const spinner = ora("Writing .env").start()
try {
let content = ""
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
import ora from "ora"
export async function writeEnvFile(config, envFilePath) {
const spinner = ora("Writing .env").start()
try {
let content = ""
Writing arbitrary config entries to an attacker-controlled envFilePath can overwrite sensitive files or place secrets into unintended locations if the path or keys/values are not validated. In the context of an auth-related skill, miswriting environment configuration can disable authentication, alter issuer/audience settings, or expose operational secrets through misconfiguration.
fs.writeFileSync(envFilePath, content)
spinner.succeed(`Updated ${envFilePath}`)
} catch (e) {
spinner.fail("Failed to write .env")
throw e
}
}
The skill explicitly instructs the agent to run a shell command (gh api ...) and references environment-variable based configuration, but it declares no permissions or allowed-tools scope. That mismatch weakens least-privilege controls because a host system may allow tool use that the skill never transparently declares, increasing the chance of unintended shell or environment access during execution.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Testing Checklist
- [ ] **Public endpoint** returns `200` without a token: `curl http://localhost:3000/api/public`
- [ ] **Protected endpoint** returns `401` without a token: `curl http://localhost:3000/api/private`
- [ ] **Protected endpoint** returns `200` with valid M2M token: `curl -H "Authorization: Bearer <token>" http://localhost:3000/api/private`
- [ ] **Scoped endpoint** returns `403` with token missing required scope
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# 1. Get a test token (from Auth0 Dashboard → APIs → Test, or via M2M credentials)
The documentation includes a live token acquisition example that embeds a client_secret in a curl request without any warning about secret handling, storage, or the risks of using production credentials in local shells and logs. While this is instructional rather than directly executable by the skill itself, it can lead users to copy sensitive credentials into terminal history, CI logs, screenshots, or shared docs.
The setup guide instructs an automatic bootstrap flow that installs dependencies and runs a script which creates remote Auth0 resources and writes a local .env file, but it does not require an explicit warning or confirmation immediately before those side effects. In an agent-executed context, this can lead to unintended project modification and cloud-side changes if the user does not fully understand what will be changed.
No suspicious patterns detected.