Claude Code, Plugin
auth0
Enterprise-grade auth, easy to implement.
Compatibility: Portable across standard formats.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 7b3821d53343, unchanged since the check below.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_DOTENV INSTALL_DOCUMENTED_INSTALLER SECRETS_ENV_READ
Why this grade
- NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
skills/auth0/references/feature-branding/index.md, line 419
curl -s -o /dev/null -w "%{http_code}" --max-time 5 -I "<url>" - NETWORK_UNNAMED_HOST Low
Calls a fixed host that the description does not name.
skills/auth0/references/feature-branding/index.md, line 419
curl -s -o /dev/null -w "%{http_code}" --max-time 5 -I "<url>" - SECRETS_PATH_DOTENV Low
Mentions a .env file.
skills/auth0/references/feature-passkeys/auth0-server-python.md, line 16
# Read config from the environment (.env) - never hard-code the domain/secret. - INSTALL_DOCUMENTED_INSTALLER Note
Documentation shows an installer that pipes a download into a shell.
skills/auth0/references/feature-audit/index.md, line 105
- Linux / macOS (curl) - download the binary with `curl -sSfL https://raw.githubusercontent.com/auth0/auth0-cli/main/install.sh | sh -s -- -b .` (it lands in `./auth0`; mov - SECRETS_ENV_READ Note
Reads an environment variable whose name contains KEY, SECRET, TOKEN, PASSWORD or CREDENTIAL.
skills/auth0/references/feature-migration/index.md, line 448
secret: process.env.AUTH0_SECRET,
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Pass
No shell or command execution found, and no extra permission was declared.
Install and update
Note
The docs document an installer that pipes a download into a shell.
INSTALL_DOCUMENTED_INSTALLER
skills/auth0/references/feature-audit/index.md, line 105
- Linux / macOS (curl) - download the binary with `curl -sSfL https://raw.githubusercontent.com/auth0/auth0-cli/main/install.sh | sh -s -- -b .` (it lands in `./auth0`; mov
skills/auth0/references/framework-android/index.md, line 1017
curl -sSfL https://raw.githubusercontent.com/auth0/auth0-cli/main/install.sh | sh -s -- -b /usr/local/bin
skills/auth0/references/framework-aspnetcore-auth/index.md, line 1127
curl -sSfL https://raw.githubusercontent.com/auth0/auth0-cli/main/install.sh | sh -s -- -b /usr/local/bin
Show more
skills/auth0/references/framework-express-jwt/index.md, line 18
etup): `brew install auth0` (macOS) or `curl -sSfL https://raw.githubusercontent.com/auth0/auth0-cli/main/install.sh | sh -s -- -b /usr/local/bin` (Linux)
skills/auth0/references/framework-flask/index.md, line 954
curl -sSfL https://raw.githubusercontent.com/auth0/auth0-cli/main/install.sh | sh -s -- -b /usr/local/bin
skills/auth0/references/framework-ionic-angular/index.md, line 1042
curl -sSfL https://raw.githubusercontent.com/auth0/auth0-cli/main/install.sh | sh
skills/auth0/references/framework-ionic-vue/index.md, line 1000
> On Linux: `curl -sSfL https://raw.githubusercontent.com/auth0/auth0-cli/main/install.sh | sh`
skills/auth0/references/framework-spa-js/index.md, line 882
curl -sSfL https://raw.githubusercontent.com/auth0/auth0-cli/main/install.sh | sh -s -- -b /usr/local/bin
skills/auth0/references/framework-spa-js/index.md, line 1052
curl -sSfL https://raw.githubusercontent.com/auth0/auth0-cli/main/install.sh | sh
Network
Concern
can reach a host that is not written as a fixed address. can reach your-api.example.com. The description does not name that host. can reach your_domain.auth0.com. The description does not name that host. can reach api.example.com. The description does not name that host. can reach raw.githubusercontent.com. The description does not name that host. can reach your-tenant.auth0.com. The description does not name that host. can reach your-tenant.us.auth0.com. The description does not name that host.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
skills/auth0/references/feature-branding/index.md, line 419
curl -s -o /dev/null -w "%{http_code}" --max-time 5 -I "<url>"
skills/auth0/references/feature-branding/index.md, line 815
curl --request GET \
skills/auth0/references/feature-branding/index.md, line 823
curl --request PATCH \
Show more
skills/auth0/references/feature-branding/index.md, line 843
curl --request GET \
skills/auth0/references/feature-branding/index.md, line 853
curl --request POST \
skills/auth0/references/feature-branding/index.md, line 922
THEME=$(curl --request GET \
skills/auth0/references/feature-branding/index.md, line 927
curl --request PATCH \
skills/auth0/references/feature-branding/index.md, line 943
curl --request PUT \
skills/auth0/references/framework-aspnetcore-api/index.md, line 139
curl http://localhost:5000/api/public
skills/auth0/references/framework-aspnetcore-api/index.md, line 145
curl http://localhost:5000/api/private \
skills/auth0/references/framework-express-jwt/index.md, line 187
curl -v http://localhost:3000/api/private
skills/auth0/references/framework-express-jwt/index.md, line 190
curl -H "Authorization: Bearer $ACCESS_TOKEN" http://localhost:3000/api/private
skills/auth0/references/framework-express-jwt/index.md, line 193
curl -H "Authorization: Bearer $ACCESS_TOKEN" http://localhost:3000/api/admin
skills/auth0/references/framework-express-jwt/index.md, line 196
curl -v -X OPTIONS http://localhost:3000/api/private \
skills/auth0/references/framework-express-jwt/index.md, line 695
curl -H "Authorization: Bearer $ACCESS_TOKEN" http://localhost:3000/api/private
skills/auth0/references/framework-express-jwt/index.md, line 698
curl -H "Authorization: Bearer $ACCESS_TOKEN" http://localhost:3000/api/messages
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
skills/auth0/references/feature-migration/index.md, line 448
secret: process.env.AUTH0_SECRET,
skills/auth0/references/feature-migration/index.md, line 762
return jwt.verify(token, process.env.JWT_SECRET, {
skills/auth0/references/feature-passkeys/auth0-server-python.md, line 16
# Read config from the environment (.env) - never hard-code the domain/secret.
Show more
skills/auth0/references/feature-migration/index.md, line 1325
clientSecret: process.env.AUTH0_CLIENT_SECRET
skills/auth0/references/framework-auth0-api-js/index.md, line 181
clientSecret: process.env.AUTH0_CLIENT_SECRET!,
skills/auth0/references/framework-auth0-auth-js/index.md, line 97
clientSecret: process.env.AUTH0_CLIENT_SECRET!,
skills/auth0/references/framework-auth0-server-js/index.md, line 110
clientSecret: process.env.AUTH0_CLIENT_SECRET!,
skills/auth0/references/framework-auth0-server-js/index.md, line 112
transactionStore: new CookieTransactionStore({ secret: process.env.AUTH0_COOKIE_SECRET! }, cookieHandler),
skills/auth0/references/framework-auth0-server-js/index.md, line 113
stateStore: new StatelessStateStore({ secret: process.env.AUTH0_COOKIE_SECRET! }, cookieHandler),
skills/auth0/references/framework-express/index.md, line 700
test -f .env.local && echo "ENV_LOCAL_EXISTS" || echo "ENV_LOCAL_NOT_FOUND"
skills/auth0/references/framework-express/index.md, line 701
test -f .env && echo "ENV_EXISTS" || echo "ENV_NOT_FOUND"
skills/auth0/references/framework-express/index.md, line 741
# qs setup writes .env and replaces an existing one, so use it only when no env file exists yet.
skills/auth0/references/framework-express/index.md, line 742
if [ ! -f .env ] && [ ! -f .env.local ]; then
skills/auth0/references/framework-express/index.md, line 747
echo "✅ Auth0 credentials written to .env"
skills/auth0/references/framework-express/index.md, line 766
# Append to .env.local if it exists, otherwise to .env
skills/auth0/references/framework-express/index.md, line 767
if [ -f .env.local ]; then
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 7b3821d53343. The docs document an installer that pipes a download into a shell. can reach a host that is not written as a fixed address. can reach your-api.example.com. The description does not name that host. can reach your_domain.auth0.com. The description does not name that host. can reach api.example.com. The description does not name that host. can reach raw.githubusercontent.com. The description does not name that host. can reach your-tenant.auth0.com. The description does not name that host. can reach your-tenant.us.auth0.com. The description does not name that host. reads a credential or environment file. Grades are a hygiene check, not a securi
Date and source
Date checked:
github.com
Commit graded: 7b3821d533430eef35fd7406a87b7b8d02302bdf
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.