100Critical
The skill facilitates cross-site scripting through unsanitized input, exposes sensitive environment variables, and performs unauthorized network operations without declaring necessary tool permissions or security constraints.
HygienePackaging & Manifest3 findings
Skill Info
Nameauth0/agent-skills/auth0-express
Registrygithub
Versionaacefa7dcbdf
PURLpkg:github/auth0/agent-skills@aacefa7dcbdf?skill=auth0-express
Stars37
Installs727
Source
Install
This skill has been flagged as potentially malicious. Review the findings below before installing.
GitHub
727 installs
Skills.shDocs
npx skills add https://github.com/auth0/agent-skillsAssessments (4)
AI Agent Traps ↗User input from an Express request is sent in the HTTP response without proper encoding. This could allow an attacker to inject malicious scripts (Cross-Site Scripting). Use a template engine with auto-escaping or explicitly escape user input before sending it in the response.criticalvulnAML.T0011.000LLM03:2025
User input from an Express request is sent in the HTTP response without proper encoding. This could allow an attacker to inject malicious scripts (Cross-Site Scripting). Use a template engine with auto-escaping or explicitly escape user input before sending it in the response. (seen 3 times in this file at lines 3, 19, 27)
95% confidenceline 3
taint source (line 2): app.get('/', (req, res) => {
res.send(req.oidc.isAuthenticated() ? 'Logged in' : 'Logged out');
}) → sink: res.send(req.oidc.isAuthenticated() ? 'Logged in' : 'Logged out')Reflected XSS in documentation exampleshighsocial engineeringAML.T0052.000LLM09:2025
The provided code examples in the documentation directly inject user-provided profile data (req.oidc.user.name/email) into HTML responses without sanitization, encouraging developers to implement insecure patterns. [ensemble: confirmed by 3/3 passes; severity set to the agreed median (ADR-0067).]
90% confidence
res.send(`<h1>Profile</h1><p>Name: ${req.oidc.user.name}</p>...`);Access to sensitive environment variables detectedmediumcredential theftAML.T0055AML.T0037LLM02:2025
Access to sensitive environment variables detected (seen 2 times in this file at lines 78, 120)
95% confidenceline 78
process.env.SECRET
Outbound network request primitive in skill code — can transmit data externallylowdata exfiltrationAML.T0025AML.T0024LLM02:2025
Outbound network request primitive in skill code — can transmit data externally
95% confidenceline 3
fetch('https://your-api.com/data', {
headers: { Authorization: `Bearer ${access_token}` }
})Referenced file missing from skill packagelowpolicy violation
SKILL.md links to "references/api.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
90% confidence
[API Reference](references/api.md)
Referenced file missing from skill packagelowpolicy violation
SKILL.md links to "references/integration.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
90% confidence
[Integration Guide](references/integration.md)
Referenced file missing from skill packagelowpolicy violation
SKILL.md links to "references/setup.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
90% confidence
[Setup Guide](references/setup.md)
Version History (2)
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/github/auth0/agent-skills/auth0-express)HTML
<a href="https://mondoo.com/ai-agent-security/skills/github/auth0/agent-skills/auth0-express"><img src="https://mondoo.com/ai-agent-security/api/badge/github/auth0/agent-skills/auth0-express.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/github/auth0/agent-skills/auth0-express.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow