Skills scaffolding-fastapi-dapr

📦

scaffolding-fastapi-dapr

Name: scaffolding-fastapi-dapr
Author: Asmayaseen

Content revision r2 Critical 🌐 Network access⚡ Contains scripts⚙️ External commands🔑 Env variables📁 Filesystem access

Build FastAPI Services with Dapr

Building consistent FastAPI microservices requires coordinated database, authentication, messaging, and testing patterns. This skill supplies reusable guidance for SQLModel, Dapr, JWT, logging, and service architecture.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Do not auto-install this skill.

The canonical policy requires operator review before any installation action.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "scaffolding-fastapi-dapr" from https://skillstore.io/skills/asmayaseen-scaffolding-fastapi-dapr.md and its manifest at https://skillstore.io/api/skills/asmayaseen-scaffolding-fastapi-dapr/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/asmayaseen-scaffolding-fastapi-dapr.md Signed manifest GET /api/skills/asmayaseen-scaffolding-fastapi-dapr/manifest Signed lockfile GET /api/skills/asmayaseen-scaffolding-fastapi-dapr/lockfile

Test it

Using "scaffolding-fastapi-dapr". Create a task API with PostgreSQL persistence.

Expected outcome:

A layered project structure for routes, models, database sessions, repositories, and services.
Separate create, update, table, and response models with validated fields.
CRUD behavior with transaction ownership, pagination, error handling, and focused tests.

Using "scaffolding-fastapi-dapr". Add Dapr events when tasks are created.

Expected outcome:

A publishing flow through the local Dapr sidecar.
A validated subscription handler that unwraps CloudEvents and enforces idempotency.
Retry and dead-letter behavior that preserves failed messages.

Using "scaffolding-fastapi-dapr". Protect routes with an external JWKS provider.

Expected outcome:

A cached JWKS retrieval design with matching key selection.
JWT checks for algorithm, issuer, audience, expiration, and required claims.
A FastAPI authentication dependency with generic client errors.

Security Audit

Critical

v9 • 7/23/2026 Open versioned report

Most static findings are lexical false positives involving SQLModel query methods, Markdown formatting, local URLs, and documented configuration. Confirmed risks include an unpinned remote installer piped to bash and SQL query logging, while semantic review found weak JWT validation, unauthenticated Dapr handlers, forced message acknowledgement, and error leakage.

Files scanned

1,946

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (5)

Critical

references/dapr-patterns.md:22

Pipe to shell pattern

curl -fsSL https://raw.githubusercontent.com/dapr/cli/master/install/install.sh | bash

The command downloads an unpinned remote script and executes it immediately with bash, enabling supply-chain code execution if the source is compromised.

High

SKILL.md:112-119 references/fastapi-patterns.md:232-238

Incomplete JWT Claim Validation

The authentication guidance omits issuer validation and disables or omits audience validation, allowing valid tokens intended for another service to be accepted.

One example performs signature decoding without issuer or audience constraints, and the detailed example explicitly disables audience verification.

High

SKILL.md:148-158 references/dapr-patterns.md:58-95

Unauthenticated Dapr Event Handlers

The examples accept event payloads and write derived records without authenticating the sidecar or authorizing the message source.

Both handler examples process request bodies without an authentication dependency, signature check, API token, or documented network restriction.

Medium

references/dapr-patterns.md:92-95 references/dapr-patterns.md:297-304

Errors Are Acknowledged as Successful

The Dapr guidance returns success after processing exceptions, which suppresses retries and can cause permanent event loss.

The guidance explicitly instructs handlers to return SUCCESS even when processing raises an exception.

Medium

references/fastapi-patterns.md:241-245 references/fastapi-patterns.md:615-616

Internal Exceptions Returned to Clients

Authentication and database examples include raw exception text in HTTP responses, which can expose implementation details and operational data.

Both examples interpolate caught exception strings directly into client-visible HTTP error details.

Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

references/fastapi-patterns.md:88

Database connection strings

engine = create_engine(DATABASE_URL, echo=True)

The production database example enables SQLAlchemy echo logging, which can expose SQL parameters and sensitive application data in logs.

High

references/sqlmodel-patterns.md:65

Database connection strings

async_engine = create_async_engine(DATABASE_URL, echo=True)

The production database example enables SQLAlchemy echo logging, which can expose SQL parameters and sensitive application data in logs.

Risk Factors

🌐 Network access (18)

references/dapr-patterns.md:22 references/dapr-patterns.md:103 references/dapr-patterns.md:139 references/dapr-patterns.md:203 references/dapr-patterns.md:311 references/dapr-patterns.md:314 references/dapr-patterns.md:334 references/dapr-patterns.md:343 references/fastapi-patterns.md:30 references/fastapi-patterns.md:194 references/fastapi-patterns.md:281 references/fastapi-patterns.md:596 references/fastapi-patterns.md:636 references/fastapi-patterns.md:637 references/fastapi-patterns.md:640 references/production-testing.md:137 SKILL.md:166 SKILL.md:258

⚡ Contains scripts (6)

references/fastapi-patterns.md:139 references/fastapi-patterns.md:312 references/fastapi-patterns.md:613 references/production-testing.md:226 references/sqlmodel-patterns.md:120 references/sqlmodel-patterns.md:210

⚙️ External commands (32)

🔑 Env variables (25)

📁 Filesystem access (1)

SKILL.md:112

Detected Patterns

Pipe to shell pattern

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/asmayaseen-scaffolding-fastapi-dapr/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/asmayaseen-scaffolding-fastapi-dapr/security.svg)](https://skillstore.io/skills/asmayaseen-scaffolding-fastapi-dapr?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/asmayaseen-scaffolding-fastapi-dapr?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/asmayaseen-scaffolding-fastapi-dapr/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/asmayaseen-scaffolding-fastapi-dapr.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

Asmayaseen. (2026). scaffolding-fastapi-dapr security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/asmayaseen-scaffolding-fastapi-dapr/audits/9

BibTeX citation

@techreport{asmayaseen-asmayaseen-scaffolding-fastapi-dapr-2026,
  author = {Asmayaseen},
  title = {scaffolding-fastapi-dapr security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/asmayaseen-scaffolding-fastapi-dapr/audits/9},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "scaffolding-fastapi-dapr security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
  - name: "Asmayaseen"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/asmayaseen-scaffolding-fastapi-dapr/audits/9"
identifiers:
  - type: other
    value: "skillstore:asmayaseen-scaffolding-fastapi-dapr:audit:9"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Create a Service Foundation

Generate a consistent FastAPI structure with SQLModel schemas, database sessions, CRUD routes, and tests.

Add Event-Driven Workflows

Introduce Dapr subscriptions, event publishing, CloudEvent handling, and scheduled callbacks.

Standardize Backend Patterns

Apply repository, service, authentication, logging, versioning, and test conventions across multiple APIs.

Try These Prompts

Create a Starter API

Create a FastAPI service for [domain]. Include SQLModel create, update, table, and response models with basic CRUD routes.

Add Persistence and Authentication

Extend my FastAPI service with asynchronous PostgreSQL sessions and JWT authentication. Validate issuer, audience, expiration, and the matching JWKS key.

Integrate Dapr Messaging

Add Dapr pub/sub to this service for [topic]. Include authenticated handlers, CloudEvent validation, idempotency, retries, and dead-letter handling.

Design a Production Architecture

Refactor this FastAPI backend into repository and service layers. Add structured logging, migrations, versioned routes, integration tests, and deployment checks.

Best Practices

Keep API schemas separate from database table models.
Let route or service boundaries own transactions and refresh objects after commits.
Validate authentication claims, event sources, payload schemas, and retry behavior before deployment.

Avoid

Do not execute remote installation scripts without pinning and integrity verification.
Do not expose Dapr callback routes without authentication or network restrictions.
Do not return raw exceptions or enable SQL query logging in production.