auth0-flutter-web
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the Auth0 SPA JS library from the official Auth0 CDN (cdn.auth0.com) to manage authentication flows within the browser.
- [EXTERNAL_DOWNLOADS]: Provides instructions to download and execute the Auth0 CLI installation script from the vendor's official GitHub repository.
- [COMMAND_EXECUTION]: Instructs the agent to use the Auth0 CLI for application provisioning, configuration of callback URLs, and enabling security features like refresh token rotation.
- [COMMAND_EXECUTION]: Includes a developer utility (tests/run-evals.mjs) that executes shell commands and orchestrates evaluations using the claude CLI.
- [PROMPT_INJECTION]: The automated evaluation runner (tests/run-evals.mjs) presents an indirect prompt injection surface by ingesting untrusted agent output into a grading prompt.
- Ingestion points: tests/run-evals.mjs reads generated code via the readAllSources function.
- Boundary markers: Absent in the judgePrompt construction logic.
- Capability inventory: tests/run-evals.mjs executes shell commands via execa and the claude CLI.
- Sanitization: No validation or escaping is applied to the ingested content before interpolation.
Audit Metadata