Skip to content

Commit 11c3e07

Browse files
feat(auth0): fold tenant audit (CheckMate) into the unified skill
Add an 'audit' intent to the unified auth0 router that runs an Auth0 CheckMate tenant configuration/security audit, produces a markdown + PDF report, and applies approved fixes via the Auth0 CLI with per-command confirmation. - SKILL.md: Step 1 intent row + Step 4 load block; extend the description. - references/feature-audit.md: full workflow (CLI bootstrap, M2M app, company context, CheckMate run, report fusion, gated apply loops). - references/feature-audit-pricing.md: feature to plan matrix (shared). - references/feature-audit-remediation.md: command-shape map + safety rules. - scripts/render_pdf.sh + assets/audit/report-template.{md,html}. - Routing eval (audit-tenant) + README coverage.
1 parent c4d1647 commit 11c3e07

9 files changed

Lines changed: 1802 additions & 2 deletions

File tree

plugins/auth0/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ npx skills add auth0/agent-skills/plugins/auth0
2828

2929
| Skill | Description | Documentation |
3030
|-------|-------------|---------------|
31-
| [auth0](skills/auth0) | Adds Auth0 authentication to any app. Covers 35+ frameworks (React, Next.js, Vue, Angular, Express, Flask, FastAPI, Spring Boot, Swift, Android, Flutter, Laravel, Go, PHP, .NET MAUI, ASP.NET Core, React Native, Expo, Ionic, and more), MFA, Organizations, custom domains, ACUL screen generation, branding, debugging auth errors, security best practices, and migration from other providers. | [SKILL.md](skills/auth0/SKILL.md) |
31+
| [auth0](skills/auth0) | Adds Auth0 authentication to any app. Covers 35+ frameworks (React, Next.js, Vue, Angular, Express, Flask, FastAPI, Spring Boot, Swift, Android, Flutter, Laravel, Go, PHP, .NET MAUI, ASP.NET Core, React Native, Expo, Ionic, and more), MFA, Organizations, custom domains, ACUL screen generation, branding, debugging auth errors, security best practices, running a tenant security & configuration audit (CheckMate), and migration from other providers. | [SKILL.md](skills/auth0/SKILL.md) |
3232

3333
## Forcing the skill with `/auth0`
3434

plugins/auth0/skills/auth0/SKILL.md

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
name: auth0
3-
description: Use when adding, fixing, or improving authentication in any app — login, logout, signup, route protection, JWT and access token validation, refresh token rotation, MFA, 2FA, passkeys, step-up auth, SSO, RBAC and permissions, Organizations for B2B multi-tenant SaaS, custom login domains, ACUL, or Universal Login branding. Use even if Auth0 isn't mentioned — applies any time a developer asks how to authenticate users, secure an API, debug a 401 Unauthorized or CORS error, fix a callback URL mismatch or redirect loop, handle 429 rate limits, or migrate from Clerk, NextAuth.js, Firebase Auth, Supabase, Cognito, or Passport.js. Covers React, Next.js, Vue, Nuxt, Angular, Express, Flask, FastAPI, Spring Boot, Go, Swift, Android, Flutter, PHP, Laravel, ASP.NET Core, React Native, Expo, Ionic, and all Auth0 SDKs.
3+
description: Use when adding, fixing, or improving authentication in any app — login, logout, signup, route protection, JWT and access token validation, refresh token rotation, MFA, 2FA, passkeys, step-up auth, SSO, RBAC and permissions, Organizations for B2B multi-tenant SaaS, custom login domains, ACUL, or Universal Login branding. Use when auditing an Auth0 tenant for security/configuration issues, running CheckMate, or fixing findings. Use even if Auth0 isn't mentioned — applies any time a developer asks how to authenticate users, secure an API, debug a 401 Unauthorized or CORS error, fix a callback URL mismatch or redirect loop, handle 429 rate limits, or migrate from Clerk, NextAuth.js, Firebase Auth, Supabase, Cognito, or Passport.js. Covers React, Next.js, Vue, Nuxt, Angular, Express, Flask, FastAPI, Spring Boot, Go, Swift, Android, Flutter, PHP, Laravel, ASP.NET Core, React Native, Expo, Ionic, and all Auth0 SDKs.
44
license: Apache-2.0
55
metadata:
66
author: Auth0 <support@auth0.com>
@@ -48,6 +48,7 @@ which reference files to load.
4848
| Build fully custom login/signup screens with your own code or framework, beyond what theme settings allow. *Auth0: Advanced Customization for Universal Login (ACUL).* | **feature:acul** |
4949
| Change how the login page looks — logo, colors, fonts, background, overall theme. *Auth0: branding, Universal Login customization.* | **feature:branding** |
5050
| Bind tokens to the client so a stolen or leaked token can't be reused/replayed from another machine. *Auth0: DPoP (Demonstrating Proof-of-Possession), sender-constrained tokens.* | **feature:dpop** |
51+
| Audit an existing Auth0 tenant for security & configuration issues and produce a report — run CheckMate, get a tenant configuration / platform development review, then optionally fix findings via the CLI. *Auth0: tenant audit, CheckMate.* | **audit** |
5152
| Ask for best practices, "is this secure?", how to handle tokens safely, "how should I do X". *Auth0: guidance / security.* | **guidance** |
5253
| Hit an error: 401 Unauthorized, 403 Forbidden, CORS, callback URL mismatch, redirect loop. *Auth0: debugging.* | **debug** |
5354
| Hit rate limiting: 429 Too Many Requests, quota exceeded. *Auth0: rate limits.* | **debug:rate-limit** |
@@ -347,6 +348,15 @@ Read: references/tooling-{tooling}.md
347348
If framework detected: Read references/framework-{framework}.md
348349
```
349350

351+
### audit
352+
```
353+
Read: references/feature-audit.md
354+
Read: references/feature-audit-pricing.md
355+
Read: references/feature-audit-remediation.md
356+
Read: references/tooling-{tooling}.md
357+
Apply findings only with per-command confirmation; verify each change by re-fetch.
358+
```
359+
350360
### upgrade-sdk
351361
```
352362
Read: references/framework-{framework}.md
Lines changed: 324 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,324 @@
1+
<!DOCTYPE html>
2+
<!--
3+
Locked HTML report template for the audit workflow (feature-audit reference).
4+
Phase 5 (report generation) substitutes every placeholder token with the same data feeding report-template.md.
5+
Visual design models the "Auth0 Platform Development Review" reference layout (orange brand accent, severity-coded chips, four-section structure).
6+
Render to PDF with scripts/render_pdf.sh (Chrome headless).
7+
-->
8+
<html lang="en">
9+
<head>
10+
<meta charset="utf-8">
11+
<title>Auth0 Platform Development Review — {{customer_name}}</title>
12+
<style>
13+
:root {
14+
--orange: #E94B1F;
15+
--orange-soft: #FCE9E2;
16+
--ink: #1A1A2E;
17+
--ink-soft: #4F4F66;
18+
--line: #E6E6EE;
19+
--bg: #FFFFFF;
20+
--severity-high: #C8260A;
21+
--severity-moderate: #C46B1D;
22+
--severity-low: #1F6FB5;
23+
--severity-pass: #1F8A4C;
24+
}
25+
@page {
26+
size: Letter;
27+
margin: 0.6in 0.7in 0.7in 0.7in;
28+
@bottom-right {
29+
content: "{{review_month_year}}";
30+
font: 9pt -apple-system, "Segoe UI", sans-serif;
31+
color: var(--ink-soft);
32+
}
33+
@bottom-left {
34+
content: "Confidential · Auth0 tenant configuration review for {{customer_name}}";
35+
font: 9pt -apple-system, "Segoe UI", sans-serif;
36+
color: var(--ink-soft);
37+
}
38+
}
39+
* { box-sizing: border-box; }
40+
html, body {
41+
margin: 0;
42+
padding: 0;
43+
color: var(--ink);
44+
background: var(--bg);
45+
font-family: -apple-system, "Inter", "Segoe UI", system-ui, sans-serif;
46+
font-size: 10.5pt;
47+
line-height: 1.45;
48+
}
49+
.header {
50+
display: flex;
51+
align-items: flex-start;
52+
justify-content: space-between;
53+
padding-bottom: 14pt;
54+
border-bottom: 3pt solid var(--orange);
55+
margin-bottom: 18pt;
56+
}
57+
.header h1 {
58+
font-size: 24pt;
59+
font-weight: 700;
60+
margin: 0 0 4pt 0;
61+
line-height: 1.15;
62+
}
63+
.header .subtitle {
64+
color: var(--ink-soft);
65+
font-size: 11pt;
66+
}
67+
.plan-badge {
68+
border: 1.5pt solid var(--orange);
69+
color: var(--orange);
70+
border-radius: 18pt;
71+
padding: 4pt 12pt;
72+
font-size: 10pt;
73+
font-weight: 600;
74+
white-space: nowrap;
75+
}
76+
.header-right {
77+
text-align: right;
78+
font-size: 10pt;
79+
color: var(--ink-soft);
80+
line-height: 1.5;
81+
}
82+
.header-right .plan-badge {
83+
display: inline-block;
84+
margin-bottom: 6pt;
85+
}
86+
.header-right .meta-line {
87+
display: block;
88+
color: var(--ink);
89+
}
90+
.meta-table {
91+
width: 100%;
92+
border-collapse: collapse;
93+
margin: 12pt 0 24pt 0;
94+
}
95+
.meta-table th, .meta-table td {
96+
text-align: left;
97+
padding: 10pt 12pt;
98+
border-bottom: 1pt solid var(--line);
99+
font-size: 10.5pt;
100+
}
101+
.meta-table th {
102+
width: 38%;
103+
color: var(--ink-soft);
104+
font-weight: 500;
105+
}
106+
.meta-table td {
107+
color: var(--ink);
108+
font-weight: 600;
109+
}
110+
h2.section {
111+
color: var(--orange);
112+
text-transform: uppercase;
113+
font-size: 11pt;
114+
letter-spacing: 0.05em;
115+
font-weight: 700;
116+
margin: 22pt 0 12pt 0;
117+
}
118+
table.data {
119+
width: 100%;
120+
border-collapse: collapse;
121+
margin: 8pt 0 18pt 0;
122+
}
123+
table.data th {
124+
text-align: left;
125+
text-transform: uppercase;
126+
font-size: 8.5pt;
127+
letter-spacing: 0.05em;
128+
color: var(--ink-soft);
129+
font-weight: 600;
130+
padding: 8pt 12pt;
131+
border-bottom: 1pt solid var(--line);
132+
}
133+
table.data td {
134+
padding: 11pt 12pt;
135+
border-bottom: 1pt solid var(--line);
136+
vertical-align: top;
137+
}
138+
table.data td.label {
139+
font-weight: 600;
140+
}
141+
.severity {
142+
display: inline-block;
143+
margin-right: 18pt;
144+
font-weight: 600;
145+
}
146+
.severity.high { color: var(--severity-high); }
147+
.severity.moderate { color: var(--severity-moderate); }
148+
.severity.low { color: var(--severity-low); }
149+
.severity.pass { color: var(--severity-pass); }
150+
.gap {
151+
border-left: 3pt solid var(--orange);
152+
padding: 4pt 0 4pt 14pt;
153+
margin: 12pt 0;
154+
}
155+
.gap .gap-name {
156+
font-weight: 700;
157+
margin-bottom: 4pt;
158+
}
159+
.gap p { margin: 0; }
160+
.opportunities th, .opportunities td {
161+
vertical-align: top;
162+
}
163+
.opportunities .feature { font-weight: 700; width: 18%; }
164+
.opportunities .challenge { width: 36%; color: var(--ink); }
165+
.opportunities .solution { width: 18%; color: var(--orange); font-weight: 600; }
166+
.opportunities .impact { width: 28%; color: var(--ink-soft); }
167+
.roadmap-banner {
168+
font-weight: 700;
169+
margin: 4pt 0 12pt 0;
170+
}
171+
.roadmap-banner em { color: var(--orange); font-style: normal; font-weight: 700; }
172+
.roadmap p { margin: 6pt 0; }
173+
.actions {
174+
list-style: none;
175+
counter-reset: action;
176+
padding: 0;
177+
margin: 6pt 0 16pt 0;
178+
}
179+
.actions li {
180+
counter-increment: action;
181+
display: flex;
182+
align-items: flex-start;
183+
margin: 6pt 0;
184+
}
185+
.actions li::before {
186+
content: counter(action);
187+
color: var(--ink-soft);
188+
font-weight: 600;
189+
width: 22pt;
190+
flex: 0 0 22pt;
191+
text-align: left;
192+
}
193+
.docs {
194+
display: grid;
195+
grid-template-columns: 1fr 1fr;
196+
gap: 8pt 12pt;
197+
margin: 8pt 0 0 0;
198+
}
199+
.docs a {
200+
display: block;
201+
padding: 10pt 14pt;
202+
border: 1pt solid var(--line);
203+
border-radius: 6pt;
204+
color: var(--orange);
205+
font-weight: 600;
206+
text-decoration: none;
207+
font-size: 10pt;
208+
}
209+
hr.section-divider {
210+
border: 0;
211+
border-top: 1pt solid var(--line);
212+
margin: 18pt 0;
213+
}
214+
.small { font-size: 9pt; color: var(--ink-soft); }
215+
</style>
216+
</head>
217+
<body>
218+
219+
<header class="header">
220+
<div>
221+
<h1>Auth0 Platform<br>Development Review</h1>
222+
{{subtitle_html}} <!-- a subtitle div reading "Prepared by <org>" if reviewer_org is non-empty; emit empty string otherwise -->
223+
</div>
224+
<div class="header-right">
225+
<span class="plan-badge">{{plan_tag}}</span>
226+
<span class="meta-line">{{customer_name}} · {{tenant_domain}}</span>
227+
<span class="meta-line">{{review_date_long}}</span>
228+
</div>
229+
</header>
230+
231+
<table class="meta-table">
232+
<tr><th>Prepared by</th><td>{{reviewer_name}}</td></tr>
233+
<tr><th>Date of Review</th><td>{{review_date_long}}</td></tr>
234+
<tr><th>Customer Account</th><td>{{customer_name}} ({{tenant_domain}})</td></tr>
235+
<tr><th>Current Auth0 Tier</th><td>{{tier}}</td></tr>
236+
<tr><th>Use Case Diagnosis</th><td>{{business_model}} — {{product_summary_short}}</td></tr>
237+
<tr><th>Recommended Plan</th><td>{{recommended_plan}} · Auth for AI Agents: {{a4aa_yes_no}}</td></tr>
238+
</table>
239+
240+
<h2 class="section">1. Account Health</h2>
241+
242+
<table class="data">
243+
<thead>
244+
<tr><th>Metric</th><th>Status</th></tr>
245+
</thead>
246+
<tbody>
247+
<tr><td class="label">Applications Registered</td><td>{{apps_count}}</td></tr>
248+
<tr><td class="label">Login Activity</td><td>{{login_activity}}</td></tr>
249+
<tr>
250+
<td class="label">Security Findings</td>
251+
<td>
252+
<span class="severity high">{{findings_high_count}} High</span>
253+
<span class="severity moderate">{{findings_moderate_count}} Moderate</span>
254+
<span class="severity low">{{findings_low_count}} Low / Info</span>
255+
<span class="severity pass">{{findings_passing_count}} Passing</span>
256+
</td>
257+
</tr>
258+
</tbody>
259+
</table>
260+
261+
<!-- gaps_html: rendered from the included gap callouts. Each block is a gap div with a
262+
gap-name heading and a one-line body paragraph. Only include gaps the data supports. -->
263+
{{gaps_html}}
264+
265+
<h2 class="section">2. Executive Summary</h2>
266+
267+
<p>{{exec_summary_paragraph}}</p>
268+
269+
<p><strong>Configuration Posture at a Glance</strong></p>
270+
271+
<table class="data">
272+
<thead>
273+
<tr><th>Severity</th><th>Count</th><th>Key Examples</th></tr>
274+
</thead>
275+
<tbody>
276+
<tr><td class="label" style="color:var(--severity-high)">High</td><td>{{findings_high_count}}</td><td>{{findings_high_examples}}</td></tr>
277+
<tr><td class="label" style="color:var(--severity-moderate)">Moderate</td><td>{{findings_moderate_count}}</td><td>{{findings_moderate_examples}}</td></tr>
278+
<tr><td class="label" style="color:var(--severity-low)">Low / Info</td><td>{{findings_low_count}}</td><td>{{findings_low_examples}}</td></tr>
279+
<tr><td class="label" style="color:var(--severity-pass)">Passing</td><td>{{findings_passing_count}} of {{findings_total_count}}</td><td>{{findings_passing_examples}}</td></tr>
280+
</tbody>
281+
</table>
282+
283+
<h2 class="section">3. Strategic Opportunities &amp; Action Plan</h2>
284+
285+
<table class="data opportunities">
286+
<thead>
287+
<tr><th>Feature Area</th><th>The Enterprise Challenge</th><th>The Solution</th><th>Strategic Impact</th></tr>
288+
</thead>
289+
<tbody>
290+
<!-- opportunities_rows: one table row per included row — feature area, a personalized
291+
challenge cell, the solution label, and the strategic impact. Every challenge cell
292+
MUST name a specific product, segment, or capability from the company context. -->
293+
{{opportunities_rows}}
294+
</tbody>
295+
</table>
296+
297+
<h2 class="section">4. Recommended Roadmap &amp; Next Steps</h2>
298+
299+
<p class="roadmap-banner">Recommended Plan: <em>{{recommended_plan}}{{a4aa_addon_suffix}}</em></p>
300+
301+
<div class="roadmap">
302+
{{plan_recommendation_paragraphs_html}}
303+
</div>
304+
305+
<p><strong>Immediate Actions — Available Today (Free)</strong></p>
306+
<ol class="actions">
307+
<!-- immediate_actions_html: one list item per item. Each must name affected apps/connections explicitly. -->
308+
{{immediate_actions_html}}
309+
</ol>
310+
311+
<p><strong>After Upgrading</strong></p>
312+
<ol class="actions">
313+
<!-- after_upgrading_html: one list item per item. -->
314+
{{after_upgrading_html}}
315+
</ol>
316+
317+
<p><strong>Key Documentation</strong></p>
318+
<div class="docs">
319+
<!-- docs_html: one anchor link per included row. Match Section 3 rows. -->
320+
{{docs_html}}
321+
</div>
322+
323+
</body>
324+
</html>

0 commit comments

Comments
 (0)