better-auth
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documents the installation of the
better-authcore package and official ecosystem plugins (e.g.,@better-auth/passkey,@better-auth/mcp) via standard package managers likebun. These resources are hosted on public registries and are associated with the framework's official ecosystem. - [COMMAND_EXECUTION]: The skill provides instructions for using the
authCLI tool (bunx auth@latest) to perform administrative tasks such as generating secrets, migrating database schemas, and creating admin users. These commands are part of the intended management workflow for the auth library and are documented for developer use. - [INDIRECT_PROMPT_INJECTION]: The framework described handles external data from OAuth providers and user registration. The skill includes specific guidance on mitigating mass-assignment and injection risks through schema validation and the use of the
input: falseproperty for sensitive user fields like roles. - [CREDENTIALS_UNSAFE]: The documentation references environment variables such as
BETTER_AUTH_SECRETand social provider secrets. These are presented as placeholders or instructions for secure environment configuration in.envfiles rather than hardcoded credentials.
Audit Metadata