fastapi-async-patterns
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The provided code snippets contain placeholder credentials in connection strings, such as "user:pass" in "postgresql+asyncpg://user:pass@localhost/db" and "mongodb://localhost:27017".
- [EXTERNAL_DOWNLOADS]: Code examples include HTTP requests to placeholder domains (e.g., "api.example.com", "store1.com", "store2.com") for instructional purposes.
- [INDIRECT_PROMPT_INJECTION]: The skill demonstrates handling untrusted input (e.g., filenames from uploads, WebSocket data) that is used in capabilities like file system access and database queries without demonstrating sanitization.
- Ingestion points: Data enters via the "filename" parameter in the "/download/{filename}" route and the "file.filename" in the "/upload" route within SKILL.md.
- Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present in the examples.
- Capability inventory: Scripts demonstrate file reading/writing via "open" and file deletion via "os.remove" in the "cleanup_temp_files" task.
- Sanitization: No path validation or input sanitization logic is included in the tutorial snippets.
Audit Metadata