Skills fastapi-app
📦
fastapi-app
Content revision r1 Safe ⚙️ External commands🌐 Network access🔑 Env variables
Build FastAPI Backends with Auth and Models
FastAPI projects need consistent structure for routes, schemas, auth, database sessions, and CORS. This skill guides Claude, Codex, and Claude Code to create maintainable backend patterns.
Supports: Claude Codex Code(CC)
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "fastapi-app" from https://skillstore.io/skills/awais68-fastapi-app.md and its manifest at https://skillstore.io/api/skills/awais68-fastapi-app/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "fastapi-app". Create a FastAPI app for student records.
Expected outcome:
- A main application structure with router registration and CORS settings.
- Student request and response schemas using Pydantic v2.
- A CRUD route plan with database and auth dependencies.
Using "fastapi-app". Add JWT authentication to my API.
Expected outcome:
- Token creation guidance with expiry settings.
- Bearer token dependency design for protected routes.
- Role-checking guidance for admin-only endpoints.
Using "fastapi-app". Review my FastAPI config before production.
Expected outcome:
- A checklist for secrets, CORS, network binding, logging, and rate limiting.
- Specific configuration changes to reduce production risk.
Security Audit
Safev11 • 7/9/2026 Open versioned report
Most backtick, URL, and reconnaissance alerts are false positives from Markdown examples, sample CORS origins, or normal FastAPI code. The confirmed risks are unsafe copied defaults for database credentials and JWT secrets, plus uvicorn commands that bind to all interfaces. No prompt injection, malware intent, or data-exfiltration behavior was found in the reviewed skill file.
1
Files scanned
671
Lines analyzed
11
Review items
0
False positives ignored
Capability review items (11)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Python getenv function
DATABASE_URL = os.getenv(
DATABASE_URL is read with a credential-bearing fallback shown immediately below. Copied sample code could run with weak default database credentials.
High
Python getenv function
SECRET_KEY = os.getenv("JWT_SECRET_KEY", "your-secret-key")
The JWT secret falls back to the literal value "your-secret-key". If copied into an app, tokens can be forged by anyone who knows the sample default.
High
getenv function call
DATABASE_URL = os.getenv(
DATABASE_URL is read with a credential-bearing fallback shown immediately below. Copied sample code could run with weak default database credentials.
High
getenv function call
SECRET_KEY = os.getenv("JWT_SECRET_KEY", "your-secret-key")
The JWT secret falls back to the literal value "your-secret-key". If copied into an app, tokens can be forged by anyone who knows the sample default.
High
Database connection strings
DATABASE_URL = os.getenv(
The sample provides a default PostgreSQL URL containing username and password placeholders. This encourages checked-in or copied database credentials instead of required configuration.
High
Database connection strings
"DATABASE_URL",
The sample provides a default PostgreSQL URL containing username and password placeholders. This encourages checked-in or copied database credentials instead of required configuration.
High
Database connection strings
engine = create_async_engine(DATABASE_URL, echo=True)
The engine uses DATABASE_URL defined above with a hardcoded credential fallback. The issue is contextual rather than direct on this line, so confidence is moderate.
High
Database connection strings
DATABASE_URL: str = "postgresql+asyncpg://user:password@localhost:5432/erp_db"
The settings example hardcodes a PostgreSQL URL with user and password values. Even as a placeholder, it is unsafe guidance for production configuration.
High
Generic API/secret keys
SECRET_KEY = os.getenv("JWT_SECRET_KEY", "your-secret-key")
The JWT secret falls back to the literal value "your-secret-key". If copied into an app, tokens can be forged by anyone who knows the sample default.
Medium
Hardcoded IP address
uvicorn main:app --reload --host 0.0.0.0 --port 8000
The development command binds uvicorn to 0.0.0.0 with reload enabled, exposing the app on all interfaces. That can unintentionally expose a debug server on a network.
Medium
Hardcoded IP address
uvicorn main:app --host 0.0.0.0 --port 8000 --workers 4
The production command binds uvicorn to 0.0.0.0 without deployment guardrails such as proxy, firewall, or TLS guidance. Copied as-is, it can expose the API broadly.
Risk Factors
⚙️ External commands (40)
SKILL.md:28-94 SKILL.md:94-105 SKILL.md:105-223 SKILL.md:223-234 SKILL.md:234-267 SKILL.md:267-269 SKILL.md:269-324 SKILL.md:324-335 SKILL.md:335-387 SKILL.md:387-389 SKILL.md:389-421 SKILL.md:421-436 SKILL.md:436-437 SKILL.md:437-440 SKILL.md:440-441 SKILL.md:441-442 SKILL.md:442-443 SKILL.md:443-444 SKILL.md:444-447 SKILL.md:447-448 SKILL.md:448-449 SKILL.md:449-452 SKILL.md:452-453 SKILL.md:453-454 SKILL.md:454-455 SKILL.md:455-456 SKILL.md:456-521 SKILL.md:521-541 SKILL.md:541-545 SKILL.md:545-560 SKILL.md:560-564 SKILL.md:564-576 SKILL.md:576-580 SKILL.md:580-596 SKILL.md:596-600 SKILL.md:600-617 SKILL.md:617-621 SKILL.md:621-647 SKILL.md:647-651 SKILL.md:651-662
🌐 Network access (12)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/awais68-fastapi-app/audits/11?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/awais68-fastapi-app?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/awais68-fastapi-app?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/awais68-fastapi-app/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/awais68-fastapi-app.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
Awais68. (2026). fastapi-app security audit report (audit version 11) [Author version unspecified]. Skillstore. https://skillstore.io/skills/awais68-fastapi-app/audits/11BibTeX citation
@techreport{awais68-awais68-fastapi-app-2026,
author = {Awais68},
title = {fastapi-app security audit report (audit version 11)},
institution = {Skillstore},
year = {2026},
number = {11},
url = {https://skillstore.io/skills/awais68-fastapi-app/audits/11},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "fastapi-app security audit report (audit version 11)"
version: "unspecified"
type: report
authors:
- name: "Awais68"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/awais68-fastapi-app/audits/11"
identifiers:
- type: other
value: "skillstore:awais68-fastapi-app:audit:11"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: High 55
Architecture
85
Maintainability
87
Content
70
Community
78
Spec Compliance
What You Can Build
Create a New API
A backend developer can scaffold a FastAPI service with routers, schemas, database sessions, and CORS settings.
Add Authenticated ERP Routes
An education platform team can add student, fee, attendance, and auth endpoints with role checks.
Standardize API Patterns
A technical lead can align FastAPI code on Pydantic v2, async sessions, pagination, and error handling.
Try These Prompts
Create a FastAPI App
Create a FastAPI backend with a main app, CORS configuration, Swagger docs, and one health route.
Add Student Routes
Add authenticated student CRUD routes using APIRouter, Pydantic v2 schemas, async SQLAlchemy sessions, and clear HTTP status codes.
Implement Auth Dependencies
Design JWT bearer authentication for this FastAPI app. Include token creation, current user dependency, admin role checks, and error responses.
Harden Production Configuration
Review the FastAPI backend for production readiness. Improve secrets handling, CORS origins, database settings, rate limiting, logging, and deployment commands.
Best Practices
- Require secrets through environment variables and fail startup when values are missing.
- Keep request schemas, response schemas, database models, and routers in separate modules.
- Use typed dependencies for database sessions, authentication, pagination, and role checks.
Avoid
- Do not copy placeholder passwords or JWT secrets into production.
- Do not expose development servers on all network interfaces without a clear need.
- Do not mix blocking database calls into async request handlers.
Frequently Asked Questions
What does this skill help build?
It helps build FastAPI backends with routers, schemas, database dependencies, CORS, JWT auth, and rate limiting patterns.
Can it generate a complete production service?
It gives strong templates and guidance, but teams must add migrations, tests, deployment settings, and security review.
Does it support Pydantic v2?
Yes. The guidance uses ConfigDict, Field validation, typed schemas, and from_attributes for ORM responses.
Can it help with authentication?
Yes. It provides JWT bearer authentication patterns, current user dependencies, and role-based access checks.
What database pattern does it use?
It focuses on async SQLAlchemy sessions with dependency injection for FastAPI route handlers.
What should be changed before production?
Replace placeholder secrets, restrict CORS origins, avoid unsafe network binding, add migrations, and run tests.