better-auth-security-best-practices

Better Auth security hardening: rate limits, secrets, CSRF, trusted origins, cookies, sessions, OAuth tokens, and audit logging. Use when reviewing auth security, brute-force protection, token handling, or deployment safety.

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-sectioned security reference packed with executable config, but it is somewhat redundant and monolithic: the complete-config example duplicates earlier sections and nothing is split into bundle files for progressive disclosure.

Suggestions

Remove the 'Complete Security Configuration Example' or replace it with a pointer, since it duplicates the per-section snippets and inflates token cost.

Split the long config reference into a referenced bundle file (e.g. references/complete-config.ts) and keep SKILL.md as a lean overview with one-level-deep links, improving progressive_disclosure.

Add an explicit validate→fix→retry feedback loop for risky changes (e.g. verifying config against installed types after edits) to lift workflow_clarity.

Dimension	Reasoning	Score
Conciseness	Mostly efficient code-plus-notes, but the 'Complete Security Configuration Example' re-shows config already covered section-by-section and every snippet repeats the `import { betterAuth }` boilerplate, so it could be tightened; it is not a wall of concept explanations Claude already knows.	2 / 3
Actionability	The body is dominated by executable, copy-paste-ready TypeScript config snippets with specific option values (e.g. `encryptOAuthTokens: true`, `customRules` for sign-in), plus a concrete DeepWiki grounding instruction, meeting the fully-executable anchor.	3 / 3
Workflow Clarity	A sequenced grounding step ('ask DeepWiki... then verify decisive details... before changing code') and a deployment 'Security Checklist' provide some checkpoints, but the document is reference-oriented with no validate→fix→retry feedback loop for risky operations, so it sits below the top anchor.	2 / 3
Progressive Disclosure	Sections are well-organized, but ~480 lines of config reference live entirely inline in SKILL.md with no bundle files (references/scripts/assets absent) to defer to, matching the 'content that should be separate is inline' anchor rather than a clean overview-with-one-level-deep-references structure.	2 / 3
	Total	9 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that states a concrete capability list and an explicit 'Use when' trigger tied to a specific framework. It is comprehensive, distinct, and free of vague fluff.

Dimension	Reasoning	Score
Specificity	Enumerates multiple concrete security areas — 'rate limits, secrets, CSRF, trusted origins, cookies, sessions, OAuth tokens, and audit logging' — under the explicit action of 'security hardening', matching the multi-item concrete-action anchor rather than the vague single-domain anchor.	3 / 3
Completeness	It clearly answers both what ('Better Auth security hardening: rate limits, secrets, CSRF...') and when via an explicit 'Use when...' trigger clause, satisfying the top anchor for both what and when.	3 / 3
Trigger Term Quality	The 'Use when' clause lists natural user phrases ('reviewing auth security, brute-force protection, token handling, or deployment safety') alongside common keywords (rate limits, CSRF, cookies, OAuth), giving good coverage of terms a user would actually say.	3 / 3
Distinctiveness Conflict Risk	It is scoped to a named framework ('Better Auth') with a distinct security-hardening niche and specific triggers, making conflict with other skills unlikely.	3 / 3
	Total	12 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: EpicenterHQ/epicenter
Path: .agents/skills/better-auth-security-best-practices/SKILL.md
Commit: cb12bcc

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.