fastapi-template-architect
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill uses the copier utility via the uvx package runner to clone a project template from gh:eslam5464/Fastapi-Template. The execution includes the --trust flag, which allows the template's post-generation tasks, specifically scripts/generate/post_gen.py, to execute on the local system to perform initial project setup such as initializing a git repository and locking dependencies.
- [EXTERNAL_DOWNLOADS]: The run_copier.sh and run_copier.ps1 scripts download the project template and the copier tool from external sources. The template is fetched from the author's GitHub repository, and copier is fetched via uvx from the official package registry.
- [DYNAMIC_EXECUTION]: The provided reference documentation in references/optional-integrations.md mentions that the CacheManager service in the template utilizes Python's pickle module for serializing cached data. The documentation includes a nosec comment and warns that this is intended for use with trusted infrastructure.
- [INDIRECT_PROMPT_INJECTION]: The SKILL.md file instructs the agent to gather user inputs such as project names, slugs, and author details. These inputs are subsequently passed as arguments to the copier command and the post_gen.py script, where they are interpolated into the generated project's files. Ingestion points: SKILL.md Step 2. Boundary markers: The skill uses snapshot notices in asset files to distinguish template code but does not specify delimiters for user-provided data. Capability inventory: File writing, git initialization, and dependency locking via post_gen.py. Sanitization: No explicit sanitization or validation is mentioned for the template substitution process.
Audit Metadata