Auth0 has published the clearest example I have seen of an agent skill with its permissions designed first. In Audit Your Auth0 Tenant with Auth0 Agent Skills, Carlos Aguilar walks through HealthCheck, a skill installed with one command, npx skills add auth0/agent-skills, that runs in a terminal or IDE, reads a live tenant, and produces a prioritized findings report across three categories: security posture, configuration accuracy, and whether the plan still fits the usage. The premise is the failure it exists to prevent: “Without live visibility into your Auth0 tenant, an agent can suggest insecure wildcard CORS origins or recommend architecture that does not match your deployed configuration, use case, or plan capabilities.”
The one number in the piece is an example application of about 2,000 monthly active users, which is illustration, not a claim. What survives is the permission model, and it is the part worth copying. “Giving an AI agent unrestricted write access to your identity infrastructure is a security risk,” so the skill uses the Auth0 CLI to create or reuse “a dedicated CheckMate machine-to-machine application with narrowly scoped read permissions,” and CheckMate queries the Management API from the developer’s own environment. The checks are specific: RS256 against HS256 token signing, DPoP configuration, CORS origins, attack protection, callback and logout URLs, grant types. Fixes are staged, previewed, and applied only after an approval prompt in the terminal. “No changes are ever applied automatically.” Read access by default, write access on explicit consent, per change. That is the pattern every agent skill touching production should ship with.
The catalog maps the audit onto Auth0’s own surface. The Auth0 provider page lists 75 API pages, and HealthCheck reads several of them: the Auth0 Clients API for callbacks, origins, and grant types, the Auth0 Attack Protection API for the brute-force and breached-password settings, the Auth0 Client Grants API for the scoped machine-to-machine grant CheckMate runs under, and the Auth0 Tenants API for tenant-wide settings. The catalog description records the Management API as OpenAPI 3.1 with 221 paths and 2,567 schemas. The agentic access profile maps 458 operations, 269 of them acting and 11 flagged human-in-the-loop.
The Kin Score is 70.0, exemplar band, carried by access clarity at 75.0 and operational transparency at 65.8, with contract quality at 63.3 and contract governance at 27.3. The Agent Readiness score is 37.2, agent-ready, and the agent skills dimension is lit, along with the MCP server, reversibility, and error semantics, so the catalog agrees Auth0 ships the thing the post describes. The unlit list is the identity layer, which is a strange thing to find on an identity company: delegated identity, protected resource metadata, dynamic client registration, and consent identity are all dark on Auth0’s own record. Idempotency is unlit too. The post’s best idea is consent before every write. The record cannot yet find where Auth0 describes that consent for an agent calling its own API.