fastapi-expert
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements and recommends strong security practices for API development. It provides templates for JWT authentication using HS256 and explicitly warns against hardcoding secrets or storing passwords in plain text, suggesting the use of environment variables and bcrypt hashing.
- [INDIRECT_PROMPT_INJECTION]: The skill patterns define an attack surface for indirect prompt injection as it handles user-provided data via API endpoints, though it utilizes robust mitigation techniques.
- Ingestion points: Request bodies, query parameters, and path parameters in endpoints defined in
SKILL.md,references/endpoints-routing.md, andreferences/migration-from-django.md. - Boundary markers: Structural validation and type enforcement are provided by Pydantic V2 models (e.g.,
UserCreate,UserUpdate). - Capability inventory: The skill primarily facilitates database interactions and routing; it does not include dangerous capabilities such as shell execution or arbitrary code evaluation.
- Sanitization: Inputs are validated against Pydantic schemas, and database operations use SQLAlchemy's parameterized query engine, which effectively mitigates traditional injection vectors.
Audit Metadata