fix(swift): remove programmatic-init example with hardcoded credentials keeping reference file leaner

[sanchitmehtagit]

Summary

The Swift reference's Programmatic Initialization section taught the explicit-credentials factory form with inline placeholders:

Auth0.webAuth(clientId: "YOUR_CLIENT_ID", domain: "YOUR_DOMAIN").start()
Auth0.authentication(clientId: "YOUR_CLIENT_ID", domain: "YOUR_DOMAIN")...

This form isn't required for the skill — the recommended Auth0.plist path already covers configuration. Lower- and mid-capability models tend to reach for the programmatic form and paste real credential values directly into Swift source, which trips the L3 security graders.

Also we should not add all integration patterns in skill . it should onloy have recommended one to keep the skill. size lean

Change

Remove the "Programmatic Initialization" section (22 lines) so the skill teaches a single, secure configuration path (Auth0.plist). It's not needed for the skill's purpose, and dropping it keeps the reference leaner — one canonical way to configure, less surface area for a model to pick the insecure branch.

The migration/detection references to webAuth(domain:clientId:) elsewhere in the file are intentionally left untouched — they identify existing call sites to upgrade during SDK migration, not patterns to author for new integrations.

Eval signal

From swift_quickstart / agent-mcp-skills in eval run 29835398213, three models copied the hardcoded-credentials pattern and failed both L3 security graders:

Model	Grade	Security graders
gpt-5.6-luna	B (77.1)	barkbook_client_abc123xyz + dev-barkbook.us.auth0.com FOUND in source
gpt-5.6-terra	B (79.5)	both hardcoded values FOUND in source
gemini-3.5-flash	B (81.7)	both hardcoded values FOUND in source

Those are the eval's placeholder client ID and domain — models substituted them into webAuth(clientId:domain:) verbatim in .swift files. Removing the section removes the pattern they were copying.

Context

Part of the eval flywheel. The companion grader fix (auth0/auth0-evals#144) makes the async/await grader correctly accept the valid webAuth(clientId:domain:) API for models that wrote correct code; this PR stops the skill from teaching it with hardcoded values.

[coderabbitai]

Warning

Review limit reached

@sanchitmehtagit, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 57 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: d87390bc-9b98-41fd-9dc3-7719ceef38ae

📥 Commits

Reviewing files that changed from the base of the PR and between 7e9ce86 and 8de2199.

📒 Files selected for processing (1)

• plugins/auth0/skills/auth0/references/framework-swift.md

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch flywheel/swift-remove-programmatic-init-hardcoded-creds

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ skillsaw — All checks passed

Full report

skillsaw 0.16.0
Linting: /home/runner/work/agent-skills/agent-skills


Scanned:
  Repo type: agentskills, coderabbit, marketplace
  Plugins:   1
  Skills:    1
  Rules run: 51
  Took:      2.2s

Summary:
  Errors:   0
  Warnings: 0
  Grade:    A (1.36 weighted violations per 10k tokens)
  314 info-level violation(s) count toward the grade — run with -v to see them

✓ All checks passed!

skillsaw 0.16.0 · config · custom rules · run