스킬 scaffolding-fastapi-dapr

📦

scaffolding-fastapi-dapr

Name: scaffolding-fastapi-dapr
Author: Asmayaseen

콘텐츠 리비전 r2 치명적 🌐 네트워크 접근⚡ 스크립트 포함⚙️ 외부 명령어🔑 환경 변수📁 파일 시스템 접근

Construir backends FastAPI Dapr

Los equipos necesitan scaffolds de backend consistentes para FastAPI, SQLModel, Dapr y autenticación JWT. Esta skill proporciona patrones orientados a producción para APIs, eventos, trabajos, acceso a datos y pruebas.

지원: Claude Codex Code(CC)

⚠️ 38 나쁨

Maintain this Skill? Claim it ⚠️ 38 나쁨

이 Skill을 자동으로 설치하지 마세요.

공식 정책에 따라 설치 작업 전에 운영자 검토가 필요합니다.

내 에이전트로 설치

이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.

에이전트 요청

Review the Skillstore skill "scaffolding-fastapi-dapr" from https://skillstore.io/skills/asmayaseen-scaffolding-fastapi-dapr.md and its manifest at https://skillstore.io/api/skills/asmayaseen-scaffolding-fastapi-dapr/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.

에이전트가 읽기 쉬운 리소스

AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.

Markdown 상세 GET /skills/asmayaseen-scaffolding-fastapi-dapr.md 서명된 manifest GET /api/skills/asmayaseen-scaffolding-fastapi-dapr/manifest 서명된 lockfile GET /api/skills/asmayaseen-scaffolding-fastapi-dapr/lockfile

테스트해 보기

"scaffolding-fastapi-dapr" 사용 중입니다. Crea una API de tareas con PostgreSQL y autenticación JWT.

예상 결과:

Un esquema de proyecto con entidades SQLModel, rutas CRUD protegidas, configuración de sesiones de base de datos y valores de entorno para configurar.

"scaffolding-fastapi-dapr" 사용 중입니다. Añade pub/sub de Dapr para eventos de tareas.

예상 결과:

Un plan de rutas de suscripción, flujo de publicación de eventos, guía de desempaquetado de CloudEvent y pasos de prueba local con sidecar.

"scaffolding-fastapi-dapr" 사용 중입니다. Prepara pruebas y logging para el lanzamiento.

예상 결과:

Plan de logging estructurado con identificadores de solicitud.
Enfoque de fixtures de prueba asíncronas para rutas respaldadas por base de datos.
Límites de repositorio y servicio para código de API mantenible.

보안 감사

치명적

v9 • 2026. 7. 23. 버전별 보고서 열기

Most static findings are lexical false positives involving SQLModel query methods, Markdown formatting, local URLs, and documented configuration. Confirmed risks include an unpinned remote installer piped to bash and SQL query logging, while semantic review found weak JWT validation, unauthenticated Dapr handlers, forced message acknowledgement, and error leakage.

스캔된 파일

1,946

분석된 줄 수

검토 항목

오탐 무시됨

확인된 보안 우려 사항 (5)

치명적

references/dapr-patterns.md:22

Pipe to shell pattern

curl -fsSL https://raw.githubusercontent.com/dapr/cli/master/install/install.sh | bash

The command downloads an unpinned remote script and executes it immediately with bash, enabling supply-chain code execution if the source is compromised.

높음

SKILL.md:112-119 references/fastapi-patterns.md:232-238

Incomplete JWT Claim Validation

The authentication guidance omits issuer validation and disables or omits audience validation, allowing valid tokens intended for another service to be accepted.

One example performs signature decoding without issuer or audience constraints, and the detailed example explicitly disables audience verification.

높음

SKILL.md:148-158 references/dapr-patterns.md:58-95

Unauthenticated Dapr Event Handlers

The examples accept event payloads and write derived records without authenticating the sidecar or authorizing the message source.

Both handler examples process request bodies without an authentication dependency, signature check, API token, or documented network restriction.

중간

references/dapr-patterns.md:92-95 references/dapr-patterns.md:297-304

Errors Are Acknowledged as Successful

The Dapr guidance returns success after processing exceptions, which suppresses retries and can cause permanent event loss.

The guidance explicitly instructs handlers to return SUCCESS even when processing raises an exception.

중간

references/fastapi-patterns.md:241-245 references/fastapi-patterns.md:615-616

Internal Exceptions Returned to Clients

Authentication and database examples include raw exception text in HTTP responses, which can expose implementation details and operational data.

Both examples interpolate caught exception strings directly into client-visible HTTP error details.

기능 검토 항목 (2)

이 스킬에 대해 예상될 수 있는 실제 로컬 기능이므로 검토가 필요하지만, 확인된 악의적 동작으로는 집계되지 않습니다.

높음

references/fastapi-patterns.md:88

Database connection strings

engine = create_engine(DATABASE_URL, echo=True)

The production database example enables SQLAlchemy echo logging, which can expose SQL parameters and sensitive application data in logs.

높음

references/sqlmodel-patterns.md:65

Database connection strings

async_engine = create_async_engine(DATABASE_URL, echo=True)

The production database example enables SQLAlchemy echo logging, which can expose SQL parameters and sensitive application data in logs.

위험 요인

🌐 네트워크 접근 (18)

references/dapr-patterns.md:22 references/dapr-patterns.md:103 references/dapr-patterns.md:139 references/dapr-patterns.md:203 references/dapr-patterns.md:311 references/dapr-patterns.md:314 references/dapr-patterns.md:334 references/dapr-patterns.md:343 references/fastapi-patterns.md:30 references/fastapi-patterns.md:194 references/fastapi-patterns.md:281 references/fastapi-patterns.md:596 references/fastapi-patterns.md:636 references/fastapi-patterns.md:637 references/fastapi-patterns.md:640 references/production-testing.md:137 SKILL.md:166 SKILL.md:258

⚡ 스크립트 포함 (6)

references/fastapi-patterns.md:139 references/fastapi-patterns.md:312 references/fastapi-patterns.md:613 references/production-testing.md:226 references/sqlmodel-patterns.md:120 references/sqlmodel-patterns.md:210

⚙️ 외부 명령어 (32)

🔑 환경 변수 (25)

📁 파일 시스템 접근 (1)

SKILL.md:112

감지된 패턴

Pipe to shell pattern

감사자: codex 감사 이력 보기 →

이 보고서 공유 및 인용

버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.

버전별 보고서 열기

보고서 링크 복사

https://skillstore.io/skills/asmayaseen-scaffolding-fastapi-dapr/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 배지

[![Skillstore security assessment](https://skillstore.io/badges/skills/asmayaseen-scaffolding-fastapi-dapr/security.svg)](https://skillstore.io/skills/asmayaseen-scaffolding-fastapi-dapr?utm_source=security_passport_badge)

HTML 배지

<a href="https://skillstore.io/skills/asmayaseen-scaffolding-fastapi-dapr?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/asmayaseen-scaffolding-fastapi-dapr/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

임베드 카드

<iframe src="https://skillstore.io/embed/skills/asmayaseen-scaffolding-fastapi-dapr.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

학술 인용 (APA · BibTeX · CFF)

APA 인용

Asmayaseen. (2026). scaffolding-fastapi-dapr security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/asmayaseen-scaffolding-fastapi-dapr/audits/9

BibTeX 인용

@techreport{asmayaseen-asmayaseen-scaffolding-fastapi-dapr-2026,
  author = {Asmayaseen},
  title = {scaffolding-fastapi-dapr security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/asmayaseen-scaffolding-fastapi-dapr/audits/9},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "scaffolding-fastapi-dapr security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
  - name: "Asmayaseen"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/asmayaseen-scaffolding-fastapi-dapr/audits/9"
identifiers:
  - type: other
    value: "skillstore:asmayaseen-scaffolding-fastapi-dapr:audit:9"
    description: "Skillstore immutable audit report identifier"

Skillstore 점수

이 점수의 이유 증거 신뢰도: 중간

아키텍처

유지보수성

콘텐츠

커뮤니티

사양 준수

만들 수 있는 것

Iniciar un servicio backend

Crear un esquema consistente de servicio FastAPI con modelos, rutas, sesiones de base de datos y pasos de ejecución local.

Añadir flujos de trabajo basados en eventos

Planificar handlers pub/sub de Dapr, publicación de eventos, trabajos programados y configuración de sidecar para microservicios.

Estandarizar patrones de producción

Documentar patrones de pruebas, logging, inyección de dependencias y repositorios para un equipo de API en Python.

이 프롬프트를 사용해 보세요

Crear una API básica

Usa scaffolding-fastapi-dapr para esbozar un servicio de tareas FastAPI con modelos SQLModel, rutas CRUD y pasos de ejecución local.

Añadir autenticación

Extiende el servicio FastAPI con autenticación JWT y JWKS, rutas protegidas y guía de autorización en Swagger.

Integrar eventos Dapr

Diseña handlers pub/sub de Dapr y publicación de eventos para eventos del ciclo de vida de tareas, incluyendo desempaquetado de CloudEvent y pruebas locales.

Diseñar arquitectura de producción

Crea un plan de backend de producción con capas de repositorio y servicio, pruebas asíncronas, logging estructurado y verificaciones de configuración de despliegue.

모범 사례

Fijar y verificar instaladores externos en lugar de redirigir scripts remotos a una shell.
Reemplazar URLs locales de placeholder y credenciales con secretos gestionados antes del despliegue.
Validar el issuer, audience, algoritmo y comportamiento de rotación de claves de JWT antes del uso en producción.

피하기

Copiar URLs de base de datos de ejemplo o credenciales de prueba en la configuración desplegada.
Tratar endpoints localhost de Dapr como APIs públicas de internet.
Desactivar comprobaciones de audience del token sin un control compensatorio documentado.

자주 묻는 질문

¿Qué ayuda a construir esta skill?

Ayuda a planificar backends FastAPI que usan SQLModel, PostgreSQL, mensajería Dapr, autenticación JWT y patrones de pruebas de producción.

¿Genera una aplicación completa?

No. Proporciona patrones de scaffolding, ejemplos y guía de implementación que un desarrollador debe adaptar y probar.

¿Qué herramientas pueden usar esta skill?

El informe enumera compatibilidad con Claude, Codex y Claude Code.

¿La configuración de Dapr está lista para producción por defecto?

No. Los componentes Dapr, secretos, nombres de pub/sub y comportamiento de Jobs API deben verificarse para el entorno objetivo.

¿Cómo deben manejarse los secretos de base de datos?

Usa variables de entorno o un almacén de secretos gestionado, y nunca hagas commit de URLs o credenciales reales de base de datos.

¿Qué comprobaciones de seguridad siguen siendo necesarias?

Revisar comandos de instalación, validación de issuer y audience de JWT, orígenes CORS, manejo de secretos y configuraciones Dapr específicas del despliegue.