Skip to content
Report library
Purpose / Other

Extension Core Infrastructure Skill Security Audit

What the author says it does (original text)

Core infrastructure providing backend connection configuration, storage client, and React app entry point.

Independent security check

Security risks found

Files checked
2
Risks found
1
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Upgrade requests a verified email address by default

Source references: 5
What we found

The migration guide says InternetIdentityProvider enables attribute verification by default and requests verified_email. Unless explicitly disabled, sign-in prompts the user to share an email address, adding personal-data disclosure to what was previously plain sign-in.

Why this matters

The user’s verified email may be provided through the authentication flow and to an application backend that consumes the attribute, adding linkable identity information to account or business data.

The migration guide explicitly says the upgraded InternetIdentityProvider enables attribute verification by default and requests verified_email. Unless the app disables it, users will be prompted to share their email at sign-in. This supports a personal-data disclosure risk, but the evidence is documentation of intended defaults, not proof that any email was collected or transmitted. Users can ask who receives the email, why it is needed, how it is retained, or confirm that the app uses withAttributes={false} to opt out.

migration/v0.x.y-to-v1.x.y.md:7In the instructionsOpen original file
`InternetIdentityProvider` now enables attribute verification by default. Existing apps that do not need email attributes must opt out explicitly.
Show 4 other places
migration/v0.x.y-to-v1.x.y.md:38In the instructionsOpen original file
### 3. `InternetIdentityProvider` attribute verification is now on by default`withAttributes` now defaults to `{}` (enabled, requesting `verified_email`). This is a non-breaking addition from Internet Identity — existing apps continue to work as before, and users are simply prompted to share their email during sign-in. No code change is required unless you want to opt out entirely:```tsx// opt out — plain sign-in, no attribute request<InternetIdentityProvider withAttributes={false}>```
SKILL.md:126In the instructionsOpen original file
- Sessions from all variants are stored the same way: `isAuthenticated`, session restore on reload, and `clear()` behave identically regardless of the variant used.- When the backend uses `caffeineai-authorization`, Google, Microsoft, and SSO sign-ins carry verified name/email attributes (and the SSO domain) to the attribute callback automatically — see the `extension-authorization` skill.
migration/v0.x.y-to-v1.x.y.md:40In the instructionsOpen original file
`withAttributes` now defaults to `{}` (enabled, requesting `verified_email`). This is a non-breaking addition from Internet Identity — existing apps continue to work as before, and users are simply prompted to share their email during sign-in. No code change is required unless you want to opt out entirely:
migration/v0.x.y-to-v1.x.y.md:43In the instructionsOpen original file
```tsx// opt out — plain sign-in, no attribute request<InternetIdentityProvider withAttributes={false}>```
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

1 instruction sections

This Skill is integration documentation, not the implementation source of the referenced npm packages. It requires projects to install the infrastructure and object-storage packages directly and says the infrastructure is included automatically in every project; therefore, the supplied files alone cannot verify those dependencies’ runtime network, storage, or credential-handling behavior.

View source
SKILL.md:28In the instructionsOpen original file
`@caffeineai/object-storage` is a peer dependency of core-infrastructure. Every project must install it as a direct npm dependency (the build template includes both packages).
SKILL.md:30In the instructionsOpen original file
## IntegrationCore infrastructure is automatically included in every project. No manual integration steps are required.

The component exposes Internet Identity authentication state and supplies the signed-in identity to a backend actor; when identity changes, it recreates the actor and invalidates and refetches dependent queries.

View source
SKILL.md:174In the instructionsOpen original file
## `useActor()` — Backend Actor HookCreates and manages a typed backend actor instance. Automatically re-creates the actor when the user's identity changes (login/logout).
SKILL.md:200In the instructionsOpen original file
When the identity changes (login, logout, or session restore), the actor is automatically re-created with the new identity and all dependent queries are invalidated and refetched.

Login sessions are restored from IndexedDB, while logout clears the stored identity; the documentation recommends using isAuthenticated to control display of signed-in UI.

View source
SKILL.md:67In the instructionsOpen original file
|---|---|---|| `identity` | `Identity \| undefined` | The user's identity (available after login or session restore) || `login` | `(options?: LoginOptions) => void` | Opens the II popup. Fire-and-forget — do not `await`. See [Sign-in variants](#sign-in-variants-plain-ii-google-microsoft-workspace-sso). || `clear` | `() => void` | Logs out and clears stored identity. Fire-and-forget. || `isAuthenticated` | `boolean` | `true` when user has a valid identity. **Use this for UI gating.** || `isInitializing` | `boolean` | `true` while `AuthClient` is loading from IndexedDB || `isLoggingIn` | `boolean` | `true` while the II popup is open |
Start here · InstructionsSKILL.md
extension-core-infrastructure
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records2 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • migration/v0.x.y-to-v1.x.y.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • migration/v0.x.y-to-v1.x.y.mdSupporting file

Operations mentioned in code and instructions

Connect to websites
SKILL.md:13In the instructionsOpen original file
# Core InfrastructureCore infrastructure extension for [Caffeine AI](https://caffeine.ai?utm_source=caffeine-skill&utm_medium=referral).
SKILL.md:123In the instructionsOpen original file
- **Microsoft**: no Azure/Entra app registration is needed — Internet Identity owns the OAuth client. Accepts both personal Microsoft accounts and work/school accounts.- **Workspace SSO**: the user enters their company domain (e.g. `acme.com`); Internet Identity discovers the company's OpenID Connect provider from `https://<domain>/.well-known/ii-openid-configuration` and signs in against it (works with Okta, Entra ID, and other OIDC providers the company has configured). Use this when the app needs a specific company's own tenant; use `provider: "microsoft"` for a one-click Microsoft button that needs no per-company setup.- Apple sign-in is not offered: Internet Identity returns no email or name claims for Apple, so the attribute callback would be empty.
Install extra software packages
migration/v0.x.y-to-v1.x.y.md:61In the instructionsOpen original file
- [ ] Optionally pass `withAttributes={false}` to `InternetIdentityProvider` to disable the II attribute request- [ ] Run `pnpm install` and verify the frontend builds without errors
Lines read
263
File checksum (to compare versions)
d546fe9a9fbeb109f04edc05d314051256a9e34c4e472303d6f09ce7fbddbc90