* fix(auth0): harden against security-scan false positives
The v2.0 re-architecture (#137) triggered a critical finding on the
Agent Trust Hub / Socket / Snyk scans. This addresses the actionable,
scan-scoped surface without removing legitimate behavior.
Placeholder URLs
- Replace registrable placeholder hostnames (your-api.com,
your-production-domain.com, your-app.com, your-spa-domain.com,
your-web-app.com, your-domain.com) with RFC-2606 example.com forms
across references/*.md. Kills the "malicious URL" finding
(your-production-domain.com) and pre-empts future URL-reputation hits.
Matches the skill's already-dominant `api.example.com` convention.
.auth0.com domain placeholders and client-id/secret tokens are left
as-is: not registrable / not URLs, so not a scanner surface.
Move the behavioral eval harness out of the skill dir
- Socket flagged tests/behavioral/graders.mjs (reads .env, pipes source
into the local `claude` CLI via execa). That's a dev-only test grader,
but it sits inside per-skill scan scope. Move tests/ -> repo-root
evals/ so the executable harness is no longer bundled with the skill
consumers install. Fix run-evals.mjs path resolution, the routing
checker's routing-cases.json lookup, the README, and the AGENTS.md
layout doc.
skillsaw: exempt template-routed reference families
- framework-*.md / tooling-*.md are routed only via the
`references/framework-{framework}.md` / `tooling-{tooling}.md`
placeholder templates, which skillsaw's literal-scan
agentskill-unreferenced-files rule can't resolve. Co-located tests
were previously (accidentally) satisfying that reachability; moving
them out exposed it. Their reachability is properly enforced by
scripts/check_router_reachability.py, so exempt the two template-routed
families in .skillsaw.yaml. feature-*/pattern-* orphan detection stays.
Verified: skillsaw --strict (0/0, grade A), check_router_reachability,
check_routing_evals, and run-evals --dry-run (17 case files) all pass.
* fix(auth0): keep load_cases skill-dir-relative for unit tests
The previous commit hardcoded routing-cases.json to repo-root evals/,
which broke scripts/test_check_routing_evals.py — the unit tests build a
self-contained temp skill with its own tests/routing-cases.json and rely
on load_cases(skill_dir) reading from that dir.
Prefer a skill-local tests/routing-cases.json when present (unit tests),
fall back to repo-root evals/routing-cases.json otherwise (production,
after the harness move). Both the pytest suite (10/10) and the real
check pass.
* chore(auth0): bump plugin + skill version to 2.0.1
Patch bump for the security-scan hardening: placeholder-URL cleanup,
eval harness move out of the skill dir, and the skillsaw template-route
exemption. No new routes or breaking changes. Updates all six plugin/
marketplace manifests and SKILL.md frontmatter in lockstep.
* Adds support swift sdk for migrating to major version releases
* Updates README.md PLUGIN.md plugin.json files
* Updates README.md, SKILL.md to have latest major version
* Migration is based on SDK code. Rather than migration guide
* Remove sequential migration
* Updates skill with code examples
* Updates requestable and mfa client related code examples. README.md and other docs updated
* Removes v1 or v2 to v3. Prompts user to specify v3 version to migrate. Removes grep based file search
* refers to latest tag on v3 instead of hardcoded tag
* Skill version set to 1.0.0
* fixes new error surface with all errors covered in skill.md
* Skill takes version as argument
* Resolve PR #104 review comments
- license: Proprietary → Apache-2.0 (CodeRabbit critical)
- Step 2: replace version prompt with arg-validation (3-check gate) + auto-resolve latest v3 when no arg; use find instead of globstar for Package.resolved
- Step 1/7/8: replace hardcoded iPhone 16 simulator with dynamic xcrun simctl lookup
- graders.json: regex [3-9] → ([3-9]|[1-9][0-9]+) to support v10+ (CodeRabbit)
- graders.ts: expand contains_any/not_contains_any to one grader per value (CodeRabbit data-loss fix)
- security.md: cat **/Auth0.plist → find . -name Auth0.plist (globstar fix)
- cursor-plugin/plugin.json: add missing comma after "major comma after" major version upgrades"
- process.md: add plaintext language tag to signature confirmation code block
* Add run-evals.mjs and PROMPT.md for swift migration eval runner
CodeRabbit flagged that package.json scripts referenced run-evals.mjs which
didn't exist in the tests directory. Copy the shared runner and add PROMPT.md
with the task prompt used for live evaluation runs.
* Rename PROMPT.md to prompt.md (kebab-case lint fix)
CI requires markdown files to be kebab-case. Update run-evals.mjs to
match the new filename.
* Fix unlabeled code block fences in security.md, process.md, SKILL.md
- security.md: add plaintext language tag to all 4 checklist blocks (lines 13, 27, 40, 48)
- process.md: add plaintext tag to backend pattern block
- SKILL.md: add plaintext tag to Carthage Cartfile block
* chore: bump plugin version to 1.1.0
Bump version so Claude Code marketplace detects new skills added
since v1.0.0: auth0-branding, auth0-custom-domains, go-jwt-middleware,
auth0-ionic-react, auth0-ionic-angular, auth0-ionic-vue.
Updated descriptions and keywords to reflect full skill catalog.
* chore: bump Cursor and Codex plugin versions to 1.1.0
Same version bump and description updates as the Claude plugin —
adds branding, custom-domains, go-jwt-middleware, ACUL, CLI, and
Ionic skills to metadata.
* Remove node setup for swift skill
* Adds auth0-react-ionic capacitor skill
* removed scripts
* updates SKILL.md with licensing information and moved evals to tests folder
* Updates docs like README.md and marketplace.json files
* Updates PLUGIN.md
* Reverts scripts from swift skill
* Adds metadata to SKILL.md
* Reverts changes to swift skill
* Fixes typo errors and skill.md issues for ionic react skill
* adds instruction to agent to never echo creds
* Corrections after rebasing to main branch
* Update plugin.json file
* auth0 angular ionic capacitor skill
* adds angular ionic capacitor skill
* Adds license information to the skill in its SKILL.md file
* Updates README.md, plugin.json and marketplace.json files
* Adds metadata to SKILL.md
* Fixes typo errors and skill.md issues for ionic angular skill
* Fixes issues with respect to auto setup
* adds instruction to agent to never echo creds
* feat: add go-jwt-middleware skill for Go API JWT validation
Adds a complete Auth0 integration skill for securing Go HTTP APIs
using github.com/auth0/go-jwt-middleware/v3. Includes SKILL.md with
quick start workflow, references (setup, integration, API), bootstrap
scripts for automated Auth0 CLI setup, and evals for measuring skill
effectiveness.
* refactor: restructure go-jwt-middleware skill for merged plugin layout
Move skill from plugins/auth0-sdks/ to plugins/auth0/ to align with
the single-plugin structure on main. Replace Node.js bootstrap scripts
with direct Auth0 CLI agent instructions. Remove evals framework.
Changes:
- Move go-jwt-middleware to plugins/auth0/skills/
- Remove scripts/ directory (bootstrap.mjs and all utils)
- Remove tests/evals/ directory
- Update setup.md with direct Auth0 CLI flow and env file safety
- Add failcheck pattern, metadata tagging, credential pre-check
- Add auth0 login interactive warning for agents
- Register skill in README.md and both plugin.json files
* fix: improve go-jwt-middleware skill setup flow and metadata
* fix: enhance setup instructions for go-jwt-middleware skill and clarify automated path checkpoints
sanchitmehtagit