スキル fastapi-repo-security-preflight
📦
fastapi-repo-security-preflight
v1.0 コンテンツリビジョン r1 中リスク 🌐 ネットワークアクセス
Review FastAPI Repository Security Before Deployment
FastAPI repositories can contain exposed credentials, unsafe SQL queries, and unprotected webhooks. This guide organizes an agent-assisted review of these risks before deployment.
対応: Claude Codex Code(CC)
自分のエージェントでインストール
このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。
エージェントリクエスト
Review the Skillstore skill "fastapi-repo-security-preflight" from https://skillstore.io/skills/nexaiguy-fastapi-repo-security-preflight.md and its manifest at https://skillstore.io/api/skills/nexaiguy-fastapi-repo-security-preflight/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。
エージェントが読めるリソース
AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。
テストする
「fastapi-repo-security-preflight」を使用しています。 Illustrative request: Review webhook verification and CORS before deployment.
期待される結果:
- High: A webhook handler processes events without verifying the sender signature.
- High: Credentialed CORS accepts arbitrary origins.
- Recommendation: Add signature verification and restrict origins before release.
- This example is illustrative, not a finding from an inspected repository.
「fastapi-repo-security-preflight」を使用しています。 Illustrative request: Can the included package enforce a security gate in CI?
期待される結果:
- The included package contains a review guide, not an executable scanner.
- Automated pass or fail enforcement requires separately implemented and tested tooling.
- No automated scan result is available from this guide alone.
セキュリティ監査
中リスクv1 • 2026/11/2 バージョン別レポートを開く
All five static findings are false positives: defensive audit language, ordinary attribution links, and a request-validation reference. No evidence found of malicious execution, credential exfiltration, or prompt injection in the included guide. One semantic finding concerns unsupported security coverage and privacy guarantees despite the explicit absence of scanner scripts.
1
スキャンされたファイル
90
解析済み行数
0
レビュー項目
0
誤検知を無視
確認済みのセキュリティ上の懸念 (1)
中
Unsupported Security Coverage and Privacy Guarantees
The guide promises deterministic AST scanning and "100% coverage" without external API privacy risks. Line 14 explicitly excludes scanner scripts and templates. These unsupported assurances can encourage reliance on an unavailable deployment gate and unverified privacy protections.
The folder contains only this guide, which explicitly excludes scanner scripts but repeatedly promises deterministic scanning and complete coverage. This supports an assurance risk, not evidence of malicious intent.
リスク要因
🌐 ネットワークアクセス (3)
監査者: codex
このレポートを共有・引用
バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。
レポートリンクをコピー
https://skillstore.io/skills/nexaiguy-fastapi-repo-security-preflight/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdownバッジ
[](https://skillstore.io/skills/nexaiguy-fastapi-repo-security-preflight?utm_source=security_passport_badge)HTMLバッジ
<a href="https://skillstore.io/skills/nexaiguy-fastapi-repo-security-preflight?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/nexaiguy-fastapi-repo-security-preflight/security.svg" alt="Skillstore security assessment" loading="lazy"></a>埋め込みカード
<iframe src="https://skillstore.io/embed/skills/nexaiguy-fastapi-repo-security-preflight.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学術引用 (APA · BibTeX · CFF)
APA形式の引用
nexaiguy. (2026). fastapi-repo-security-preflight security audit report (audit version 1) [Author version 1.0]. Skillstore. https://skillstore.io/skills/nexaiguy-fastapi-repo-security-preflight/audits/1BibTeX形式の引用
@techreport{nexaiguy-nexaiguy-fastapi-repo-security-preflight-2026,
author = {nexaiguy},
title = {fastapi-repo-security-preflight security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/nexaiguy-fastapi-repo-security-preflight/audits/1},
note = {Author version 1.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "fastapi-repo-security-preflight security audit report (audit version 1)"
version: "1.0"
type: report
authors:
- name: "nexaiguy"
date-released: "2026-11-02"
url: "https://skillstore.io/skills/nexaiguy-fastapi-repo-security-preflight/audits/1"
identifiers:
- type: other
value: "skillstore:nexaiguy-fastapi-repo-security-preflight:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore スコア
このスコアの理由 証拠の信頼度: 中 55
アーキテクチャ
85
保守性
87
コンテンツ
65
コミュニティ
83
仕様準拠
作成できるもの
Review an API Before Release
Use the checklist to inspect credentials, configuration, SQL queries, and webhook verification before approving a FastAPI release.
Assess a Legacy Service
Organize a repository review around the documented FastAPI risks and request evidence for each reported issue.
Define Deployment Review Criteria
Translate the documented checks into review criteria, then implement and test separate tooling for CI enforcement.
これらのプロンプトを試す
Start a Focused Review
Review this FastAPI repository for exposed secrets and insecure CORS settings. Report evidence and redact credential values. Do not modify files.
Inspect Queries and Request Models
Inspect FastAPI routes for unsafe SQL construction and missing Pydantic validation. Cite real files and explain each risk. Separate confirmed issues from uncertainty.
Trace Webhook Verification
Trace each webhook from request receipt to side effects. Identify missing signature verification, cite evidence, and propose focused fixes and tests.
Evaluate Deployment Readiness
Review the FastAPI repository against this guide. Use only available tools and disclose missing scanner support. Prioritize findings and propose independently testable deployment criteria.
ベストプラクティス
- Request file and line evidence for each finding, and redact secrets from reports.
- Verify available tooling before relying on automated scanning or CI enforcement.
- Combine repository review with runtime tests and independent security tooling.
回避
- Treating the guide as an installed deterministic scanner.
- Assuming complete vulnerability coverage or guaranteed privacy from descriptive claims.
- Publishing credential values or approving deployment without validating reported fixes.
よくある質問
Does this package include a runnable scanner?
No. The included file is a public guide. It explicitly excludes scanner scripts, extension source, and templates.
Which security topics does the guide cover?
It covers exposed secrets, unsafe SQL, insecure FastAPI configuration, webhook signature verification, and Pydantic request validation.
Which technologies does it target?
The guide targets Python 3.11+, FastAPI, Pydantic, Uvicorn, and SQLAlchemy or raw SQL drivers.
Can it automatically block a deployment?
Not by itself. The guide describes deployment gating, but executable scanner logic and CI integration are not included.
Does it guarantee complete security coverage?
No. Complete coverage claims are unsupported by the included files. Static review can also miss dynamic behavior and runtime vulnerabilities.
Does it keep repository data entirely local?
The guide does not enforce local processing. Data handling depends on your agent, model provider, tools, and configuration.