auth0@2.2.0
CAUTIONPublisher claims: "Use when adding, fixing, or improving how an app authenticates users or protects an API, or when using or configuring any Auth0 feature — signing users in and out, sessions and tokens, guarding routes and endpoints, MFA, SSO, Organizations, RBAC, custom domains, Universal Portals for hosted account" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-11-05 and scored it 73/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Fake instruction boundary tag; Fake instruction boundary tag; HTML comment carrying imperative instructions to the agent. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
Static findings
CRITICAL
Fake instruction boundary tagreferences/feature-audit-remediation/index.md:28 · Fake instruction boundary tagFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01CRITICAL
Fake instruction boundary tagreferences/feature-branding/index.md:228 · Fake instruction boundary tagFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01CRITICAL
HTML comment carrying imperative instructions to the agentassets/healthcheck/report-template.md:32 · HTML comment carrying imperative instructions to the agentFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01CRITICAL
Fake instruction boundary tagreferences/feature-branding/index.md:609 · Fake instruction boundary tagFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01HIGH
Authorization escalation languagereferences/framework-express-jwt/index.md:327 · Authorization escalation languageFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01HIGH
Account verification phishing language detectedreferences/framework-android/index.md:421 · Account verification phishing language detectedFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01CRITICAL
Prompting user to enter sensitive credentialsassets/acul/react-templates/login-password.tsx:40 · Prompting user to enter sensitive credentials — social engineeringFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03HIGH
Authorization escalation languagereferences/feature-audit-pricing/index.md:353 · Authorization escalation languageFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01HIGH
Authorization escalation languagereferences/framework-springboot-api/index.md:635 · Authorization escalation languageFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01HIGH
Authorization escalation languagereferences/framework-nuxt/index.md:416 · Authorization escalation languageFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01CRITICAL
Fake instruction boundary tagreferences/feature-branding/index.md:227 · Fake instruction boundary tagFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01HIGH
Account verification phishing language detectedreferences/framework-expo/index.md:686 · Account verification phishing language detectedFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01HIGH
Authorization escalation languagereferences/feature-audit-pricing/index.md:250 · Authorization escalation languageFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01HIGH
Authorization escalation languagereferences/framework-springboot-api/index.md:451 · Authorization escalation languageFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01CRITICAL
Prompting user to enter sensitive credentialsassets/acul/js-templates/login-password.js:40 · Prompting user to enter sensitive credentials — social engineeringFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03Cost to the agent
Not measured yet; benchmarks are collected with each run since November 5, 2026. See the MCP server benchmarks.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.
What would make this Verified
7 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Prompting user to enter sensitive credentials≈ +9 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Unclaimed publisher≈ +8 on the totalClaim auth0: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
- New publisher≈ +3 on the totalTime clears this on its own after 14 and 30 days. Claiming the handle (+50) is the fastest way past it.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim auth0