fastapi-auth-patterns
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
scripts/setup-jwt.shscript automates the installation of industry-standard Python packages, includingfastapi,python-jose,pwdlib, andpython-multipart, viapip. These are well-known libraries appropriate for the skill's stated purpose. - [INDIRECT_PROMPT_INJECTION]: The skill implements authentication flows that process untrusted external data. Ingestion points: Authentication tokens are ingested in
jwt_auth.py(viaoauth2_scheme) andsupabase_auth.py(viasecurity). Boundary markers: Present, as the skill utilizes JWT signature verification and Pydantic model validation. Capability inventory: No dangerous system capabilities (e.g., arbitrary code execution or network exfiltration) are triggered based on this processed data. Sanitization: Present, using industry-standard JWT decoding and Pydantic schema enforcement. - [COMMAND_EXECUTION]: The skill includes utility scripts that perform standard configuration tasks using common shell commands such as
opensslfor key generation andpipfor dependency management. These commands are transparent and align with standard developer initialization workflows.
Audit Metadata