better-auth
Pass
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a legitimate collection of guides, templates, and utility scripts for the Better Auth framework. It aims to assist developers in setting up robust authentication for applications on Cloudflare Workers, Next.js, and other platforms.
- [DATA_EXPOSURE_AND_EXFILTRATION]: While the skill handles sensitive data such as authentication secrets and database connection strings, it explicitly instructs users to manage these via secure methods like environment variables,
.dev.vars(which are excluded from version control), and Cloudflare's secrets management (e.g.,wrangler secret put). - [EXTERNAL_DOWNLOADS]: The skill references several official and well-known documentation sites and repositories (better-auth.com, github.com/better-auth, orm.drizzle.team, stripe.com). These are trusted sources for the technology stack described.
- [COMMAND_EXECUTION]: The included shell scripts (
setup-d1-drizzle.sh,generate-secret.sh,test-auth-health.sh) are utility scripts for local development environments. They perform standard operations like package installation, secret generation, and local health checks. No suspicious remote code execution or shell injection patterns were detected. - [INDIRECT_PROMPT_INJECTION]: As an authentication skill, it naturally handles untrusted user input (credentials, emails). The skill and the framework it documents include standard mitigations such as password hashing (Scrypt/Bcrypt), CSRF protection, and origin validation to handle this surface area securely.
Audit Metadata