* fix(auth0): harden against security-scan false positives
The v2.0 re-architecture (#137) triggered a critical finding on the
Agent Trust Hub / Socket / Snyk scans. This addresses the actionable,
scan-scoped surface without removing legitimate behavior.
Placeholder URLs
- Replace registrable placeholder hostnames (your-api.com,
your-production-domain.com, your-app.com, your-spa-domain.com,
your-web-app.com, your-domain.com) with RFC-2606 example.com forms
across references/*.md. Kills the "malicious URL" finding
(your-production-domain.com) and pre-empts future URL-reputation hits.
Matches the skill's already-dominant `api.example.com` convention.
.auth0.com domain placeholders and client-id/secret tokens are left
as-is: not registrable / not URLs, so not a scanner surface.
Move the behavioral eval harness out of the skill dir
- Socket flagged tests/behavioral/graders.mjs (reads .env, pipes source
into the local `claude` CLI via execa). That's a dev-only test grader,
but it sits inside per-skill scan scope. Move tests/ -> repo-root
evals/ so the executable harness is no longer bundled with the skill
consumers install. Fix run-evals.mjs path resolution, the routing
checker's routing-cases.json lookup, the README, and the AGENTS.md
layout doc.
skillsaw: exempt template-routed reference families
- framework-*.md / tooling-*.md are routed only via the
`references/framework-{framework}.md` / `tooling-{tooling}.md`
placeholder templates, which skillsaw's literal-scan
agentskill-unreferenced-files rule can't resolve. Co-located tests
were previously (accidentally) satisfying that reachability; moving
them out exposed it. Their reachability is properly enforced by
scripts/check_router_reachability.py, so exempt the two template-routed
families in .skillsaw.yaml. feature-*/pattern-* orphan detection stays.
Verified: skillsaw --strict (0/0, grade A), check_router_reachability,
check_routing_evals, and run-evals --dry-run (17 case files) all pass.
* fix(auth0): keep load_cases skill-dir-relative for unit tests
The previous commit hardcoded routing-cases.json to repo-root evals/,
which broke scripts/test_check_routing_evals.py — the unit tests build a
self-contained temp skill with its own tests/routing-cases.json and rely
on load_cases(skill_dir) reading from that dir.
Prefer a skill-local tests/routing-cases.json when present (unit tests),
fall back to repo-root evals/routing-cases.json otherwise (production,
after the harness move). Both the pytest suite (10/10) and the real
check pass.
* chore(auth0): bump plugin + skill version to 2.0.1
Patch bump for the security-scan hardening: placeholder-URL cleanup,
eval harness move out of the skill dir, and the skillsaw template-route
exemption. No new routes or breaking changes. Updates all six plugin/
marketplace manifests and SKILL.md frontmatter in lockstep.
* feat(android): add auth0-android-major-migration skill
Adds a spec-driven skill that upgrades an existing com.auth0.android:auth0
(v3) integration to the next major version (v4), the Android counterpart to
auth0-swift-major-migration.
The skill is source-driven and grep-gated: it fetches the v4 SDK's actual
Kotlin source to confirm signatures, audits which Auth0 APIs the project
actually calls, and applies only the breaking changes that affect real call
sites — then builds until green and emits a migration summary.
Target version is argument-based: an optional version argument is validated
(must be a published tag, within the next major, and not a downgrade) and the
skill stops and asks on failure; when omitted it auto-resolves the latest v4
release (including pre-releases). Covers the v4 prerequisite gate (minSdk 26,
Java 17, Gradle/AGP/Kotlin) and the documented breaking and behavioral changes.
Includes references (process, security), an eval suite, and registers the
skill across the plugin manifests and READMEs.
* fix(android): address markdownlint nits in migration skill docs
Add blank lines around fenced code blocks (MD031) and language
specifiers on checklist/diagram fences (MD040) in SKILL.md, process.md,
and security.md. Docs-only; no behavioral change.
* docs(android): note expires_in JSON key is unchanged; renumber §9 subsections
* Adds support swift sdk for migrating to major version releases
* Updates README.md PLUGIN.md plugin.json files
* Updates README.md, SKILL.md to have latest major version
* Migration is based on SDK code. Rather than migration guide
* Remove sequential migration
* Updates skill with code examples
* Updates requestable and mfa client related code examples. README.md and other docs updated
* Removes v1 or v2 to v3. Prompts user to specify v3 version to migrate. Removes grep based file search
* refers to latest tag on v3 instead of hardcoded tag
* Skill version set to 1.0.0
* fixes new error surface with all errors covered in skill.md
* Skill takes version as argument
* Resolve PR #104 review comments
- license: Proprietary → Apache-2.0 (CodeRabbit critical)
- Step 2: replace version prompt with arg-validation (3-check gate) + auto-resolve latest v3 when no arg; use find instead of globstar for Package.resolved
- Step 1/7/8: replace hardcoded iPhone 16 simulator with dynamic xcrun simctl lookup
- graders.json: regex [3-9] → ([3-9]|[1-9][0-9]+) to support v10+ (CodeRabbit)
- graders.ts: expand contains_any/not_contains_any to one grader per value (CodeRabbit data-loss fix)
- security.md: cat **/Auth0.plist → find . -name Auth0.plist (globstar fix)
- cursor-plugin/plugin.json: add missing comma after "major comma after" major version upgrades"
- process.md: add plaintext language tag to signature confirmation code block
* Add run-evals.mjs and PROMPT.md for swift migration eval runner
CodeRabbit flagged that package.json scripts referenced run-evals.mjs which
didn't exist in the tests directory. Copy the shared runner and add PROMPT.md
with the task prompt used for live evaluation runs.
* Rename PROMPT.md to prompt.md (kebab-case lint fix)
CI requires markdown files to be kebab-case. Update run-evals.mjs to
match the new filename.
* Fix unlabeled code block fences in security.md, process.md, SKILL.md
- security.md: add plaintext language tag to all 4 checklist blocks (lines 13, 27, 40, 48)
- process.md: add plaintext tag to backend pattern block
- SKILL.md: add plaintext tag to Carthage Cartfile block
* chore: bump plugin version to 1.1.0
Bump version so Claude Code marketplace detects new skills added
since v1.0.0: auth0-branding, auth0-custom-domains, go-jwt-middleware,
auth0-ionic-react, auth0-ionic-angular, auth0-ionic-vue.
Updated descriptions and keywords to reflect full skill catalog.
* chore: bump Cursor and Codex plugin versions to 1.1.0
Same version bump and description updates as the Claude plugin —
adds branding, custom-domains, go-jwt-middleware, ACUL, CLI, and
Ionic skills to metadata.
Frederik Prijck