better-auth
Pass
Audited by Gen Agent Trust Hub on Apr 24, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The better_auth_init.py script presents a surface for indirect prompt injection during the initialization process. External data provided during the interactive setup is interpolated into generated TypeScript files. \n- Ingestion points: The script uses input() to collect database connection strings and provider credentials in scripts/better_auth_init.py. \n- Boundary markers: No delimiters or code-injection warnings are present in the generated output templates. \n- Capability inventory: The script has the capability to create and overwrite local files (e.g., auth.ts, .env) via Path.write_text(). \n- Sanitization: Basic whitespace and quote stripping are performed, but there is no validation to prevent TypeScript code injection if a malicious string is provided as input. \n- [COMMAND_EXECUTION]: The documentation and setup instructions reference the use of npx @better-auth/cli, which executes the framework's CLI tools directly from the npm registry. While this is standard practice for the library, it involves executing external code.
Audit Metadata