auth-server-primitives
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill demonstrates excellent security practices for web authentication, such as the use of the
__Host-cookie prefix,HttpOnly,Secure, andSameSiteflags, and explicit warnings against trusting client-side route guards for API security. - [INDIRECT_PROMPT_INJECTION]: The skill documents how to handle untrusted user input within server functions.
- Ingestion points: Data is ingested via
createServerFnthrough the.validator()and.handler()methods. - Boundary markers: The skill mandates the use of Zod schemas for input validation and strict delimiters between context and user data.
- Capability inventory: Handlers have the capability to perform database operations, manage cookies, and trigger redirects.
- Sanitization: The instructions emphasize performing membership and authorization checks (e.g., verifying
userIdagainst the session) after parsing data to prevent unauthorized access to tenant or user records.
Audit Metadata