Skills fastapi-templates
📦

fastapi-templates

Content revision r2 High Risk 🌐 Network access🔑 Env variables⚙️ External commands

Build Structured Async FastAPI Services

New FastAPI services often mix routing, data access, and business logic. This skill provides layered patterns for async APIs, authentication, persistence, and tests.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "fastapi-templates" from https://skillstore.io/skills/sickn33-fastapi-templates.md and its manifest at https://skillstore.io/api/skills/sickn33-fastapi-templates/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/sickn33-fastapi-templates.md Signed manifest GET /api/skills/sickn33-fastapi-templates/manifest Signed lockfile GET /api/skills/sickn33-fastapi-templates/lockfile

Test it

Using "fastapi-templates". Plan an inventory API with products and warehouses.

Expected outcome:

  • A module map separating inventory routes, schemas, services, and repositories.
  • Async session dependencies with transaction and rollback behavior.
  • Product and warehouse endpoint responsibilities with validation boundaries.
  • Focused repository, service, and API test scenarios.

Using "fastapi-templates". Add secure profile update and deletion flows.

Expected outcome:

  • Authenticated endpoints with explicit owner or administrator authorization.
  • Service methods for validated updates and deletion outcomes.
  • Consistent forbidden, missing-record, and validation responses.
  • Tests for owners, unrelated users, administrators, and invalid tokens.

Using "fastapi-templates". Review an async FastAPI project before deployment.

Expected outcome:

  • A prioritized review of blocking calls, session lifecycle, and transaction handling.
  • Checks for CORS restrictions, secret management, token validation, and object authorization.
  • Recommended integration tests for startup, database failures, authentication, and permissions.

Security Audit

High Risk
v5 • 7/23/2026 Open versioned report

All 15 static findings are benign documentation examples or scanner misclassifications. However, the playbook includes a user lookup without object-level authorization and a permissive CORS configuration. These template flaws require correction before production use.

2
Files scanned
608
Lines analyzed
0
Review items
0
False positives ignored

Confirmed security concerns (2)

High
resources/implementation-playbook.md:362-372
Missing Object-Level Authorization
The user lookup requires authentication but returns any record selected by user_id without an ownership or role check.
The endpoint receives current_user but never uses it before returning the requested user. Adjacent update and delete endpoints explicitly enforce ownership.
Medium
resources/implementation-playbook.md:95-101
Overly Permissive CORS Template
The application example enables credentials while allowing every origin, method, and header, which encourages an unsafe production configuration.
The complete application pattern explicitly combines wildcard CORS settings with credentials. No environment-specific restriction or warning is provided.

Risk Factors

🌐 Network access (1)
resources/implementation-playbook.md:519
🔑 Env variables (7)
resources/implementation-playbook.md:114 resources/implementation-playbook.md:135 resources/implementation-playbook.md:491 resources/implementation-playbook.md:501 resources/implementation-playbook.md:115 resources/implementation-playbook.md:428 resources/implementation-playbook.md:464
⚙️ External commands (2)
SKILL.md:31 SKILL.md:35
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/sickn33-fastapi-templates/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/sickn33-fastapi-templates/security.svg)](https://skillstore.io/skills/sickn33-fastapi-templates?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/sickn33-fastapi-templates?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-fastapi-templates/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/sickn33-fastapi-templates.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

sickn33. (2026). fastapi-templates security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-fastapi-templates/audits/5

BibTeX citation

@techreport{sickn33-sickn33-fastapi-templates-2026, author = {sickn33}, title = {fastapi-templates security audit report (audit version 5)}, institution = {Skillstore}, year = {2026}, number = {5}, url = {https://skillstore.io/skills/sickn33-fastapi-templates/audits/5}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "fastapi-templates security audit report (audit version 5)" version: "unspecified" type: report authors: - name: "sickn33" date-released: "2026-07-23" url: "https://skillstore.io/skills/sickn33-fastapi-templates/audits/5" identifiers: - type: other value: "skillstore:sickn33-fastapi-templates:audit:5" description: "Skillstore immutable audit report identifier"

Compare variants

2 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Higher Skillstore usage
wshobson Recommended

wshobson-fastapi-templates

Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 8
Updated

2026-08-21

sickn33 Current

sickn33-fastapi-templates

Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 7
Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: Medium
55
Architecture
85
Maintainability
87
Content
69
Community
83
Spec Compliance

What You Can Build

Start a Backend Service

Define a maintainable package structure and async request flow for a new FastAPI service.

Standardize Team Architecture

Separate routes, services, repositories, schemas, and configuration across a shared Python API.

Teach Async API Patterns

Explain dependency injection, async sessions, authentication, and integration testing through connected examples.

Try These Prompts

Plan a Basic Service 
Design a FastAPI project structure for [service], including routes, schemas, services, repositories, configuration, and tests.
Add Async Persistence 
Add async SQLAlchemy persistence for [entity], with session dependencies, repository methods, validation schemas, and rollback behavior.
Implement Authentication 
Design JWT authentication for [application], including password hashing, token validation, ownership checks, configuration, and failure responses.
Review Production Readiness 
Review this FastAPI architecture for async correctness, authorization, CORS, session handling, error consistency, test coverage, and deployment risks: [details].

Best Practices

  • Keep route handlers small and place business rules in services.
  • Use async-compatible clients and database drivers throughout each request path.
  • Test authorization, transaction rollback, validation, and error responses independently.

Avoid

  • Do not copy wildcard CORS settings into a production service.
  • Do not treat authentication as authorization for user-selected resources.
  • Do not mix synchronous database operations into async route handlers.

Frequently Asked Questions

Does this skill generate a complete FastAPI repository?
No. It supplies architecture guidance and connected snippets that require project-specific implementation.
Which database style does it demonstrate?
It demonstrates async SQLAlchemy sessions and mentions PostgreSQL and MongoDB as possible targets.
Does it include authentication guidance?
Yes. It covers password hashing, JWT signing and validation, and authenticated-user dependencies.
Can I use the CORS example in production?
No. Replace wildcard settings with an explicit allowlist and minimum required methods, headers, and credential behavior.
What testing support is included?
It shows async pytest fixtures, dependency overrides, an in-memory database, and one API creation test.
Which AI tools support this skill?
The marketplace metadata lists Claude, Codex, and Claude Code.

Developer Details

Author

sickn33

License

MIT

Skillstore revision

r2

Version notice

The author did not declare a version.

Repository

https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/fastapi-templates

Ref

88a8e9a07f4c54ab105c1c41b6267c287146b07b

Maintenance freshness

7/26/2026

Usage

6 downloads · 143 views

File structure

📁 resources/

📄 implementation-playbook.md

📄 SKILL.md