better-auth-best-practices

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches documentation, configuration indices, and versioning information from the official Better Auth website and project-specific lockfiles.
  • [COMMAND_EXECUTION]: Instructions direct the agent to perform setup, migrations, and schema generation using standard CLI tools such as npm, npx, prisma, and drizzle-kit. This includes vendor-specific commands like npx auth@latest migrate.
  • [INDIRECT_PROMPT_INJECTION]: The skill directs the agent to ingest external instructions from vendor documentation, which creates a surface for influencing agent behavior.
  • Ingestion points: Fetches content from better-auth.com/llms.txt in SKILL.md to resolve package versions and documentation identifiers.
  • Boundary markers: Absent; the agent is instructed to pass result paths to the documentation tool unchanged.
  • Capability inventory: The skill employs npm and npx for package installation and command execution throughout the setup workflow.
  • Sanitization: No validation or sanitization is defined for the content retrieved from external URLs before the agent processes it.
  • [SAFE]: Environment variable management practices in the skill follow industry standards by recommending BETTER_AUTH_SECRET and BETTER_AUTH_URL for secret management instead of hardcoding credentials.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 07:47 PM