better-auth
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides patterns for handling user profile data retrieved from external social providers (Google, GitHub, Microsoft, Apple) and registration forms.
- Ingestion points: External user data such as email, name, and profile images are ingested via authentication handlers and React client hooks described in
SKILL.md. - Boundary markers: None explicitly provided in the code snippets, as the skill relies on the
better-authlibrary's internal handling of auth protocols. - Capability inventory: The skill uses
Bashfor project setup and database migrations, and performs network requests for authentication flows. - Sanitization: The skill recommends using the library's built-in protections for CSRF, password hashing (
bcryptjs), and secure session management. - [COMMAND_EXECUTION]: The skill documents the use of standard CLI tools for development, including
npm,pnpm, andyarnfor package management, andwranglerfor Cloudflare D1 database operations such aswrangler d1 executeandwrangler d1 create. - [EXTERNAL_DOWNLOADS]: The skill fetches dependencies from the official NPM registry and references documentation from well-known and official sources, including
better-auth.com, Google Cloud Console, Azure Portal, and official GitHub repositories for the framework.
Audit Metadata