The Agent Skills Directory

[SAFE]: The skill implements authentication using JSON Web Key Sets (JWKS), an industry-standard best practice for secure, stateless authentication. It correctly uses asymmetric cryptography (Ed25519) to verify tokens without sharing private keys between services.
[COMMAND_EXECUTION]: The instructions include standard commands for package management (pip install, npm install) and database migrations (npx @better-auth/cli migrate, alembic upgrade head). These are routine development tasks and are not considered malicious in this context.
[EXTERNAL_DOWNLOADS]: The skill fetches public keys from a JSON Web Key Set (JWKS) endpoint provided by the user's Better Auth instance. This is a core part of the authentication flow and targets the developer's own infrastructure. All external package dependencies listed (e.g., fastapi, python-jose, httpx) are well-known, reputable libraries.
[DATA_EXPOSURE]: The skill provides templates for managing sensitive configuration via environment variables (.env, .env.local), which is a recommended security practice for secrets management. No hardcoded credentials or sensitive data exfiltration patterns were detected.
[INDIRECT_PROMPT_INJECTION]: The skill handles external data in the form of JWT tokens. It mitigates injection risks by implementing robust server-side verification using standard cryptographic libraries, including checks for expiration (exp), issuer (iss), and audience (aud) claims.
[SAFE]: The documentation includes a comprehensive security checklist that encourages best practices such as HTTPS enforcement, CORS restrictions, and row-level security in the database.

betterauth-fastapi-jwt-bridge