Trust Assessment
auth0 received a trust score of 86/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Potential Command Injection via unescaped shell variables in `curl` examples.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential Command Injection via unescaped shell variables in `curl` examples The skill's documentation (`SKILL.md`) provides `curl` command examples that directly embed environment variables (`$AUTH0_DOMAIN`, `$AUTH0_MGMT_TOKEN`) and placeholder values (`{userId}`) into shell commands. If an AI agent or any system were to execute these commands, and if the values for these variables or placeholders were derived from untrusted user input without proper sanitization or shell escaping, it could lead to command injection. An attacker could inject arbitrary shell commands by manipulating the content of these variables, potentially leading to unauthorized command execution on the host system. When executing shell commands constructed from variables, ensure all variable content is properly escaped or quoted to prevent shell injection. For example, use `printf %q` in bash for each argument, or utilize a programming language's safe subprocess execution API that does not interpret shell metacharacters (e.g., `subprocess.run` with `shell=False` in Python, passing arguments as a list). Ensure that any user-controlled input used to populate these variables is strictly validated and sanitized. | LLM | SKILL.md:11 |
Scan History
Embed Code
[](https://skillshield.io/report/f45d57f7dbe2f46f)
Powered by SkillShield