The Agent Skills Directory

[SAFE]: No malicious patterns or security violations were detected. The skill follows best practices for a complex migration tool, incorporating user confirmation steps and clear documentation.
[COMMAND_EXECUTION]: The skill uses a variety of system commands for project triage and verification:
grep and find are used to map Auth0 integration points in the codebase.
git clone is used to fetch the official descope-migration utility from GitHub.
npm, pip, and go handle dependency management and project compilation checks.
curl is used for smoke testing the local development server and verifying JWT claims.
[EXTERNAL_DOWNLOADS]: The skill downloads dependencies and tools from trusted sources:
Clones the migration script from github.com/descope/descope-migration.
Installs official Descope SDKs from standard registries (NPM and PyPI).
References the Descope Docs MCP server at docs-mcp.descope.com for real-time documentation lookups.
[DATA_EXFILTRATION]: While the skill scans sensitive files like .env, Dockerfile, and package.json, it does so solely to identify configuration needs and map environment variables for the new provider. No behavior suggesting the transmission of discovered data to unauthorized external domains was observed.
[PROMPT_INJECTION]: The skill is designed to process untrusted codebase content during its analysis phase, which represents an attack surface for indirect prompt injection:
Ingestion points: Codebase Analysis section in SKILL.md (scanning project files via grep).
Boundary markers: Absent; analyzed content hits are summarized directly in the agent's context.
Capability inventory: Subprocess execution (shell commands), file system write access (refactoring source files), and network access (dependency installation).
Sanitization: Absent; the skill relies on the agent's logic to interpret codebase hits correctly and requires user review of the generated MIGRATION-PLAN.md before execution.

auth0-to-descope