Two clear rules:
1. Never retrieve/parse client_secret from CLI output unless user
explicitly asked — secret access is user-driven.
2. Write-only .env — append if exists, auto-add to .gitignore,
never read (avoids exposing existing secrets in context).
Patterns adopted from auth0-mcp-server#94:
- Append behavior (preserve existing file content)
- Auto .gitignore for target file
- Agent never retrieves secrets it wasn't given
Distinguish between user-provided secrets (write to .env) and
transient CLI output secrets (instruct user to copy). The prior
approach of never writing secrets contradicted the credentials-provided
eval path where users explicitly provide all three values.
Addresses code review findings:
- Add "summarize plan and confirm" step before Auth0 mutations (expo, swift)
- Make connection patching explicit about preserving existing enabled_clients
- Fix swift setup to extract both client_id and domain from CLI output
- Renumber swift setup steps after inserting confirmation step
Remove bundled Node.js scripts (execa, ora, inquirer) from auth0-expo
and auth0-swift skills. Convert to agent-native instructions that use
Auth0 CLI directly — same operations, no npm supply chain or
programmatic shell execution.
Fix auth0-java-mvc-common to never write CLIENT_SECRET to files.
Agent writes domain/client-id only; user sets secret manually.
Add "never echo credentials in response text" instruction to all three
skills to prevent credential exposure in agent output.
Addresses Snyk W007 (HIGH) — insecure credential handling via bundled
executable scripts that process Auth0 credentials programmatically.
The pip package is named `auth0-fastapi-api`, but the actual Python module
is `fastapi_plugin` (defined in pyproject.toml and __init__.py of the SDK
repo at github.com/auth0/auth0-fastapi-api).
The skill previously used `from auth0_fastapi_api import Auth0FastAPI` in
all code examples across SKILL.md, references/api.md, and
references/integration.md. This import would fail at runtime with an
ImportError since no `auth0_fastapi_api` module exists.
This was caught by eval runs in auth0-evals: the holistic judge for the
fastapi_api_quickstart eval flagged the wrong import across multiple
models (claude-opus-4-6, claude-sonnet-4-6, gpt-5.4). Models that
had access to the actual SDK repo (via MCP/web) correctly used
`from fastapi_plugin import Auth0FastAPI` and were penalized by the
judge for not matching the (incorrect) skill instructions.
The correct import is:
from fastapi_plugin import Auth0FastAPI
* fix: update PLUGIN.md and CONTRIBUTING.md for single-plugin architecture
After #50 merged auth0-sdks into auth0, PLUGIN.md and CONTRIBUTING.md
still documented the old two-plugin architecture.
PLUGIN.md: Complete rewrite reflecting single unified plugin
CONTRIBUTING.md: Update all paths from plugins/auth0-sdks/ to plugins/auth0/
* fix: add missing README.md to tree, normalize keywords across configs
- PLUGIN.md: add plugins/auth0/README.md to directory tree
- Normalize keyword lists across Claude/Cursor marketplace.json and
Cursor plugin.json to identical 27-keyword set
- Add missing keywords: flask, springboot, java, spa-js
- Remove stale keywords: servlet, java-mvc, express-jwt, fastify-api
The auth0-angular skill presented both the HTTP interceptor and
getAccessTokenSilently() without making it clear they are two
alternative approaches for attaching tokens to API calls. This could
mislead users into thinking both are needed simultaneously.
* feat: add skill for flask quickstart
* feat:update documentation for integration and setup
* feat: add auth0-flask skill integration to README
* feat: update auth0-flask documentation and remove test mocks
* feat: remove known limitations and common patterns from API reference
* fix: Addressed Review Comments
* feat: add reference docs, fix quickstart runtime issues, and resolve merge conflicts for auth0-flask skill
* feat: add eval infrastructure and fix review feedback for auth0-flask skill
* fix: correct filename casing for prompt.md in eval file loading
* fix: rename PROMPT.md to prompt.md for kebab-case lint and remove package-lock.json
* fix: improve exception handling and update documentation for access token retrieval and user injection
* docs: clarify usage of load_dotenv for environment variable loading in SKILL.md
* fix: enhance error message for access token retrieval in api_call function
---------
Co-authored-by: Frederik Prijck <frederik.prijck@okta.com>
* feat: add auth0-expo skill and update related documentation for Expo integration
* feat: enhance auth0-expo skill documentation with detailed integration patterns and setup instructions
* feat(auth0-expo): implement bootstrap script for Auth0 configuration in Expo projects
* feat(auth0-expo): add tests and evaluation criteria for Auth0 integration in Expo applications
* feat(auth0-expo): add prompt for Auth0 authentication integration in Expo applications
* feat: update Auth0 SDK skills in PLUGIN.md to include Android and Swift
* feat: enhance Auth0 Expo skill setup instructions for automatic and manual configurations
* feat: add node-oauth2-jwt-bearer skill and docs update
* feat: update SKILL.md to include license and author metadata
* fix: address PR review comments for express-oauth2-jwt-bearer skill
* fix: Add DPoP to CORS allowedHeaders in api.md and integration.md
Add created_by=agent_skills metadata to all auth0 apps create commands
across all quickstart skills to enable tracking and instrumentation of
apps created via agent skills.
Changes:
- Updated all setup scripts (Bash and PowerShell) to include --metadata flag
- Applied to auth0-express, auth0-nextjs, auth0-vue, auth0-react,
auth0-angular, auth0-react-native skills
- Updated auth0-quickstart documentation with metadata examples
- Verified syntax with Auth0 CLI v1.27.0
Co-authored-by: Claude <noreply@anthropic.com>
Nandan Prabhu