スキル fastapi-app 監査履歴
📦

監査履歴

fastapi-app - 6 監査

監査バージョン 6

最新 低リスク

Jan 21, 2026, 04:50 PM

All static findings are false positives. The skill provides legitimate FastAPI development guidance. Pattern detections (C2 keywords, weak crypto, command execution) are misidentifications of standard code examples and documentation URLs in the SKILL.md file.

2
スキャンされたファイル
1,766
解析された行数
3
検出結果
claude
監査者
低リスクの問題 (1)
Documentation references detected as patterns
Static scanner flagged documentation URLs (fastapi.tiangolo.com, docs.pydantic.dev) as network targets. These are legitimate documentation references in the SKILL.md References section.

リスク要因

📁 ファイルシステムへのアクセス (1)
⚡ スクリプトを含む (1)

監査バージョン 5

中リスク

Jan 16, 2026, 05:55 PM

AI analysis failed after multiple attempts - MANUAL REVIEW REQUIRED before publishing. This skill cannot be auto-published until reviewed by a human.

2
スキャンされたファイル
879
解析された行数
4
検出結果
claude
監査者
セキュリティ問題は見つかりませんでした

検出されたパターン

Ruby/shell backtick executionHardcoded URLHidden file accessPython getenv functiongetenv function callGeneric API/secret keysC2 keywordsWeak cryptographic algorithmHardcoded IP addressDatabase connection stringsEnvironment file accessSystem reconnaissanceNetwork reconnaissance[HEURISTIC] DANGEROUS COMBINATION: Code execution + Network + Credential access[HEURISTIC] SUSPICIOUS COMBINATION: Filesystem + Credentials + Network

監査バージョン 4

中リスク

Jan 16, 2026, 05:55 PM

AI analysis failed after multiple attempts - MANUAL REVIEW REQUIRED before publishing. This skill cannot be auto-published until reviewed by a human.

2
スキャンされたファイル
879
解析された行数
4
検出結果
claude
監査者
セキュリティ問題は見つかりませんでした

検出されたパターン

Ruby/shell backtick executionHardcoded URLHidden file accessPython getenv functiongetenv function callGeneric API/secret keysC2 keywordsWeak cryptographic algorithmHardcoded IP addressDatabase connection stringsEnvironment file accessSystem reconnaissanceNetwork reconnaissance[HEURISTIC] DANGEROUS COMBINATION: Code execution + Network + Credential access[HEURISTIC] SUSPICIOUS COMBINATION: Filesystem + Credentials + Network

監査バージョン 3

低リスク

Jan 10, 2026, 11:07 AM

This is a documentation/prompt skill containing code examples for legitimate FastAPI backend development. The skill provides guidance on app setup, routing, database connections, and authentication patterns. No executable code or direct system access. Minor security concern identified with default JWT secret fallback.

1
スキャンされたファイル
671
解析された行数
2
検出結果
claude
監査者
低リスクの問題 (1)
Default JWT secret fallback
The auth dependency example provides a default secret key if JWT_SECRET_KEY is not set: `SECRET_KEY = os.getenv("JWT_SECRET_KEY", "your-secret-key")`. While this is a common pattern in examples, it creates a weak default that developers might overlook. Attackers could exploit this if developers deploy without setting a proper secret. The code correctly recommends environment variable configuration elsewhere (line 623-645).

リスク要因

監査バージョン 2

低リスク

Jan 10, 2026, 11:07 AM

This is a documentation/prompt skill containing code examples for legitimate FastAPI backend development. The skill provides guidance on app setup, routing, database connections, and authentication patterns. No executable code or direct system access. Minor security concern identified with default JWT secret fallback.

1
スキャンされたファイル
671
解析された行数
2
検出結果
claude
監査者
低リスクの問題 (1)
Default JWT secret fallback
The auth dependency example provides a default secret key if JWT_SECRET_KEY is not set: `SECRET_KEY = os.getenv("JWT_SECRET_KEY", "your-secret-key")`. While this is a common pattern in examples, it creates a weak default that developers might overlook. Attackers could exploit this if developers deploy without setting a proper secret. The code correctly recommends environment variable configuration elsewhere (line 623-645).

リスク要因

監査バージョン 1

低リスク

Jan 10, 2026, 11:07 AM

This is a documentation/prompt skill containing code examples for legitimate FastAPI backend development. The skill provides guidance on app setup, routing, database connections, and authentication patterns. No executable code or direct system access. Minor security concern identified with default JWT secret fallback.

1
スキャンされたファイル
671
解析された行数
2
検出結果
claude
監査者
低リスクの問題 (1)
Default JWT secret fallback
The auth dependency example provides a default secret key if JWT_SECRET_KEY is not set: `SECRET_KEY = os.getenv("JWT_SECRET_KEY", "your-secret-key")`. While this is a common pattern in examples, it creates a weak default that developers might overlook. Attackers could exploit this if developers deploy without setting a proper secret. The code correctly recommends environment variable configuration elsewhere (line 623-645).

リスク要因