Skip to content
skillsafebeta
← Report library
Purpose / Data analysis

Better Auth Best Practices Skill Security Audit

What the author says it does (original text)

Configure Better Auth server and client, set up database adapters, manage sessions, add plugins, and handle environment variables. Use when users mention Better Auth, betterauth, auth.ts, or need to set up TypeScript authentication with email/password, OAuth, or plugin configuration.

Independent security check

Security risks found

Files checked
1
Risks found
4
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

Migration and generation commands execute an unpinned remote CLI

Source references: 4
What we found

The workflow repeatedly uses `npx auth@latest`. `npx` may download and execute the currently published CLI rather than the Better Auth version locked by the project. This also conflicts with the Skill's own version-matching guidance.

Why this matters

If the newest release is compromised, affected by a supply-chain incident, or incompatible with the project, it runs with the developer's permissions and may generate an incorrect schema or apply incompatible migrations.

The Skill requires documentation to match the installed project version, yet specifies `auth@latest` for migration and generation. This can run a newer CLI against an older project and alter its database or generated files. Users can require every CLI command to use the resolved compatible version rather than `latest`.

SKILL.md:10In the instructionsOpen original file
Use documentation that matches the Better Auth version installed in the project. APIs and plugin names can differ across maintained release lines.1. Prefer a version explicitly named by the user.2. Otherwise, inspect the resolved `better-auth` version in the lockfile, falling back to the package manifest when no lockfile is available.3. When the Better Auth MCP is available, call `get_doc` with `/llms.txt` to resolve that package version to a documentation identifier. Pass the identifier to every `search_docs` call and pass result paths to `get_doc` unchanged.4. Without MCP, start at [better-auth.com/llms.txt](https://better-auth.com/llms.txt) and follow the matching version index.5. Use the latest documentation only when the project version cannot be determined or the user explicitly asks about the latest release or an upgrade.
Show 3 other places
SKILL.md:28In the instructionsOpen original file
4. Create route handler for your framework5. Run migrations:   - **Built-in adapter:** `npx auth@latest migrate`   - **Drizzle:** `npx auth@latest generate --output src/db/auth-schema.ts` then `npx drizzle-kit push` (dev) or `npx drizzle-kit generate && npx drizzle-kit migrate` (prod)   - **Prisma:** `npx auth@latest generate --output prisma/schema.prisma` then `npx prisma migrate dev`6. Verify: call `GET /api/auth/ok` — should return `{ status: "ok" }`
SKILL.md:13In the instructionsOpen original file
1. Prefer a version explicitly named by the user.2. Otherwise, inspect the resolved `better-auth` version in the lockfile, falling back to the package manifest when no lockfile is available.3. When the Better Auth MCP is available, call `get_doc` with `/llms.txt` to resolve that package version to a documentation identifier. Pass the identifier to every `search_docs` call and pass result paths to `get_doc` unchanged.
SKILL.md:29In the instructionsOpen original file
5. Run migrations:   - **Built-in adapter:** `npx auth@latest migrate`   - **Drizzle:** `npx auth@latest generate --output src/db/auth-schema.ts` then `npx drizzle-kit push` (dev) or `npx drizzle-kit generate && npx drizzle-kit migrate` (prod)   - **Prisma:** `npx auth@latest generate --output prisma/schema.prisma` then `npx prisma migrate dev`6. Verify: call `GET /api/auth/ok` — should return `{ status: "ok" }`
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 1
Medium risk

The workflow can directly alter database schemas and generated schema files

Source references: 2
What we found

The instructions make `migrate`, Drizzle `push`, and Prisma development migration standard steps and name schema output paths, without requiring migration-plan review, target-database confirmation, or a backup first.

Why this matters

If credentials point to the wrong database or generated changes conflict with existing models, this can cause lasting schema changes, authentication outages, or data loss.

These are active commands in the standard workflow: `migrate`, Drizzle `push`, and `migrate` alter databases, while generation writes to named schema paths. The visible instructions do not require confirming the database target, previewing diffs, or taking a backup. Users can restrict them to local/test databases and require review of generated files and migration SQL before writes.

SKILL.md:28In the instructionsOpen original file
4. Create route handler for your framework5. Run migrations:   - **Built-in adapter:** `npx auth@latest migrate`   - **Drizzle:** `npx auth@latest generate --output src/db/auth-schema.ts` then `npx drizzle-kit push` (dev) or `npx drizzle-kit generate && npx drizzle-kit migrate` (prod)   - **Prisma:** `npx auth@latest generate --output prisma/schema.prisma` then `npx prisma migrate dev`6. Verify: call `GET /api/auth/ok` — should return `{ status: "ok" }`
Show 1 other places
SKILL.md:181In the instructionsOpen original file
6. **Change email flow** - Sends to current email first, then new email7. **Drizzle: db not initialized** - `drizzleAdapter(db, ...)` requires a `db` instance from `drizzle()`. See `create-auth` skill for setup examples (node-postgres, postgres.js, Neon).8. **Drizzle: missing drizzle.config.ts** - `drizzle-kit` commands require a `drizzle.config.ts` pointing to the generated schema file and DB credentials.
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 2
Low risk

The install command does not pin a dependency version

Source references: 7
What we found

The installation command does not specify dependency versions. The same command may download different code later, so what you install can differ from what was checked.

Why this matters

A later install may download different code even though the command and this report have not changed.

This is an active installation step. `npm install better-auth` has no version constraint, so it may resolve to different releases over time and run their install lifecycle scripts. Users can ask for an explicit version matching the project lockfile and review package and lockfile changes before installation.

`npx auth@latest migrate` explicitly selects the latest CLI available at execution time and runs a database-changing migration. It is not guaranteed to match the installed Better Auth version. Users can require a pinned compatible CLI version and confirm the target database and migration contents first.

The Drizzle flow first downloads and executes the unpinned latest `auth` CLI; the `npx drizzle-kit` commands also do not pin a version in the command. The development `push` can directly alter a database. Users can restrict execution to reviewed local versions from the lockfile and require migration generation and review first.

The Prisma flow executes `npx auth@latest`, so the generator being run changes with the latest release; the following migration command can also modify the development database. Users can require a version compatible with installed dependencies and inspect generated files and the migration plan first.

The quick reference again gives `npx auth@latest migrate`. `latest` selects a mutable remote release at execution time, and the command applies database schema changes. Users can require a pinned version, constrain the target database, and preview the migration first.

This generation command uses unpinned `auth@latest`; its output can change over time and may rewrite Prisma or Drizzle schema files in the project. Users can require a locked version and review the diff before accepting generated output.

This command uses an unpinned latest CLI and is intended to change AI-tool configuration by adding MCP to Cursor. The risk includes both version drift and changing configuration or tool connections. Users can require a pinned, reviewed CLI and disclosure of the files and endpoints affected.

SKILL.md:24In the instructionsOpen original file
1. Install: `npm install better-auth`2. Set env vars: `BETTER_AUTH_SECRET` and `BETTER_AUTH_URL`
Show 6 other places
SKILL.md:29In the instructionsOpen original file
5. Run migrations:   - **Built-in adapter:** `npx auth@latest migrate`   - **Drizzle:** `npx auth@latest generate --output src/db/auth-schema.ts` then `npx drizzle-kit push` (dev) or `npx drizzle-kit generate && npx drizzle-kit migrate` (prod)
SKILL.md:30In the instructionsOpen original file
   - **Built-in adapter:** `npx auth@latest migrate`   - **Drizzle:** `npx auth@latest generate --output src/db/auth-schema.ts` then `npx drizzle-kit push` (dev) or `npx drizzle-kit generate && npx drizzle-kit migrate` (prod)   - **Prisma:** `npx auth@latest generate --output prisma/schema.prisma` then `npx prisma migrate dev`
SKILL.md:31In the instructionsOpen original file
   - **Drizzle:** `npx auth@latest generate --output src/db/auth-schema.ts` then `npx drizzle-kit push` (dev) or `npx drizzle-kit generate && npx drizzle-kit migrate` (prod)   - **Prisma:** `npx auth@latest generate --output prisma/schema.prisma` then `npx prisma migrate dev`6. Verify: call `GET /api/auth/ok` — should return `{ status: "ok" }`
SKILL.md:48In the instructionsOpen original file
### CLI Commands- `npx auth@latest migrate` - Apply schema (built-in adapter)- `npx auth@latest generate` - Generate schema for Prisma/Drizzle
SKILL.md:49In the instructionsOpen original file
- `npx auth@latest migrate` - Apply schema (built-in adapter)- `npx auth@latest generate` - Generate schema for Prisma/Drizzle- `npx auth@latest mcp --cursor` - Add MCP to AI tools
SKILL.md:50In the instructionsOpen original file
- `npx auth@latest generate` - Generate schema for Prisma/Drizzle- `npx auth@latest mcp --cursor` - Add MCP to AI tools
Low risk

A CLI command can modify AI-tool configuration to add MCP

Source references: 1
What we found

The quick reference offers `npx auth@latest mcp --cursor`, described as adding MCP to AI tools. The source does not state which configuration is changed, what tool capabilities are enabled, or which endpoints are contacted.

Why this matters

Running it may persistently change Cursor/AI-tool configuration and expand the integrations available to the agent; the exact permissions cannot be determined from the supplied source.

This is an executable quick-reference command explicitly intended to add MCP to Cursor/AI tools, but the source does not state which configuration it changes, what service it connects to, or what tool capabilities it grants. Users can request the exact config diff, endpoints, and permissions and prevent execution until explicitly approved.

SKILL.md:47In the instructionsOpen original file
### CLI Commands- `npx auth@latest migrate` - Apply schema (built-in adapter)- `npx auth@latest generate` - Generate schema for Prisma/Drizzle- `npx auth@latest mcp --cursor` - Add MCP to AI tools
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

This Skill is an integration guide for Better Auth covering dependency installation, environment variables, authentication configuration, routing, database migrations, and a health check. The supplied source contains operational instructions but no accompanying scripts.

View source
SKILL.md:22In the instructionsOpen original file
## Setup Workflow1. Install: `npm install better-auth`2. Set env vars: `BETTER_AUTH_SECRET` and `BETTER_AUTH_URL`3. Create `auth.ts` with database + config4. Create route handler for your framework5. Run migrations:   - **Built-in adapter:** `npx auth@latest migrate`   - **Drizzle:** `npx auth@latest generate --output src/db/auth-schema.ts` then `npx drizzle-kit push` (dev) or `npx drizzle-kit generate && npx drizzle-kit migrate` (prod)   - **Prisma:** `npx auth@latest generate --output prisma/schema.prisma` then `npx prisma migrate dev`6. Verify: call `GET /api/auth/ok` — should return `{ status: "ok" }`

It instructs the agent to select documentation based on the project's installed version and to separate current-version guidance from upgrade-target guidance.

View source
SKILL.md:10In the instructionsOpen original file
Use documentation that matches the Better Auth version installed in the project. APIs and plugin names can differ across maintained release lines.1. Prefer a version explicitly named by the user.2. Otherwise, inspect the resolved `better-auth` version in the lockfile, falling back to the package manifest when no lockfile is available.3. When the Better Auth MCP is available, call `get_doc` with `/llms.txt` to resolve that package version to a documentation identifier. Pass the identifier to every `search_docs` call and pass result paths to `get_doc` unchanged.4. Without MCP, start at [better-auth.com/llms.txt](https://better-auth.com/llms.txt) and follow the matching version index.5. Use the latest documentation only when the project version cannot be determined or the user explicitly asks about the latest release or an upgrade.When planning an upgrade, separate guidance for the currently installed version from guidance for the target version.

The security section lists an option to force secure cookies and explicitly labels disabling CSRF and origin checks as risky; these are reference notes, not instructions to disable the checks by default.

View source
SKILL.md:119In the instructionsOpen original file
## Security**In `advanced`:**- `useSecureCookies` - Force HTTPS cookies- `disableCSRFCheck` - ⚠️ Security risk- `disableOriginCheck` - ⚠️ Security risk  - `crossSubDomainCookies.enabled` - Share cookies across subdomains- `ipAddress.ipAddressHeaders` - Custom IP headers for proxies- `database.generateId` - Custom ID generation or `"serial"`/`"uuid"`/`false`
Start here · InstructionsSKILL.md
better-auth-best-practices
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 7 more sections are available in the original file.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Connect to websites
SKILL.md:15In the instructionsOpen original file
3. When the Better Auth MCP is available, call `get_doc` with `/llms.txt` to resolve that package version to a documentation identifier. Pass the identifier to every `search_docs` call and pass result paths to `get_doc` unchanged.4. Without MCP, start at [better-auth.com/llms.txt](https://better-auth.com/llms.txt) and follow the matching version index.5. Use the latest documentation only when the project version cannot be determined or the user explicitly asks about the latest release or an upgrade.
SKILL.md:40In the instructionsOpen original file
- `BETTER_AUTH_SECRET` - Encryption secret (min 32 chars). Generate: `openssl rand -base64 32`- `BETTER_AUTH_URL` - Base URL (e.g., `https://example.com`)
SKILL.md:188In the instructionsOpen original file
- [Docs](https://better-auth.com/docs)- [Options Reference](https://better-auth.com/docs/reference/options)
Install extra software packages
SKILL.md:24In the instructionsOpen original file
1. Install: `npm install better-auth`2. Set env vars: `BETTER_AUTH_SECRET` and `BETTER_AUTH_URL`
SKILL.md:29In the instructionsOpen original file
5. Run migrations:   - **Built-in adapter:** `npx auth@latest migrate`   - **Drizzle:** `npx auth@latest generate --output src/db/auth-schema.ts` then `npx drizzle-kit push` (dev) or `npx drizzle-kit generate && npx drizzle-kit migrate` (prod)
SKILL.md:30In the instructionsOpen original file
   - **Built-in adapter:** `npx auth@latest migrate`   - **Drizzle:** `npx auth@latest generate --output src/db/auth-schema.ts` then `npx drizzle-kit push` (dev) or `npx drizzle-kit generate && npx drizzle-kit migrate` (prod)   - **Prisma:** `npx auth@latest generate --output prisma/schema.prisma` then `npx prisma migrate dev`
Read keys or account settings
SKILL.md:151In the instructionsOpen original file
**Popular plugins:** `twoFactor`, `organization`, `passkey`, `magicLink`, `emailOtp`, `username`, `phoneNumber`, `admin`, `apiKey`, `bearer`, `jwt`, `multiSession`, `sso`, `oauthProvider`, `oidcProvider`, `openAPI`, `genericOAuth`.
SKILL.md:182In the instructionsOpen original file
7. **Drizzle: db not initialized** - `drizzleAdapter(db, ...)` requires a `db` instance from `drizzle()`. See `create-auth` skill for setup examples (node-postgres, postgres.js, Neon).8. **Drizzle: missing drizzle.config.ts** - `drizzle-kit` commands require a `drizzle.config.ts` pointing to the generated schema file and DB credentials.
Lines read
193
File checksum (to compare versions)
402b523b36cc8cdd4efc83a1c8cb25c56c7327d08ecb168746456a0eaa2c1ea2