auth0-winforms
Pass
Audited by Gen Agent Trust Hub on May 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes instructions to download the Auth0 CLI installation script from the vendor's official GitHub repository (
https://raw.githubusercontent.com/auth0/auth0-cli/main/install.sh). - [REMOTE_CODE_EXECUTION]: The setup guide features a shell script that executes the vendor's CLI installer via
curl | sh. This is a documented and standard procedure for setting up the vendor's development tools. - [COMMAND_EXECUTION]: The skill utilizes several CLI tools to automate the development workflow, including
gh apito fetch the latest release versions,dotnetfor package management and building, and theauth0CLI for tenant and application configuration. - [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface as it is instructed to read the user's project files (
.csproj) and search the codebase usinggrepto identify existing configurations. - Ingestion points: Identifying TargetFramework from
.csprojinSKILL.mdand runninggrepon project files insetup.md. - Boundary markers: Absent.
- Capability inventory: External API calls via
gh, script execution viacurl | sh, and project modification viadotnetandauth0CLI. - Sanitization: Absent.
- [SAFE]: The skill implements industry-standard security patterns for native desktop applications, specifically the Authorization Code flow with PKCE, and explicitly warns against the use of Client Secrets in native clients.
Audit Metadata