auth0-to-descope

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt instructs the agent to collect and record sensitive values (Project ID, DESCOPE_MANAGEMENT_KEY, AUTH0_TOKEN, etc.) into migration state and .env files and to embed them in example requests, which requires the LLM to handle/output secret values verbatim.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly depends on the Descope Docs MCP (server URL: https://docs-mcp.descope.com/mcp) which it will query at runtime via search/ask tools to verify SDK method names (directly controlling generated prompts/code), and it also references cloning and running remote code from the repository git@github.com:descope/descope-migration.git (git clone + python commands) which fetches and executes third‑party code during migration — both are runtime external dependencies that meet the flagged criteria.