fastapi-router-py

The skill fastapi-router-py consists of a main SKILL.md description, a Python template file (assets/template.py), and an acceptance-criteria.md reference document.

1. SKILL.md: This file describes the purpose of the skill and provides instructions for using the template. It does not contain any executable commands, prompt injection attempts, or references to external, unverified sources for execution. The instructions are purely informational.

2. assets/template.py: This is a Python code template designed to be copied and modified by the user. It uses standard FastAPI and Python typing imports. All other imports (app.auth.jwt, app.models.*, app.services.*) are relative imports, assuming a specific project structure where the user will integrate this template. The skill itself does not execute this Python code, nor does it instruct the agent to execute it. There are no file system operations (beyond standard module imports), network requests, or any other potentially malicious actions within this template.

3. references/acceptance-criteria.md: This file serves as a detailed guide for correct and incorrect FastAPI patterns. It is purely informational and contains no executable content or malicious patterns.

Threat Category Review:

• Prompt Injection: No patterns detected in any file.
• Data Exfiltration: No file system access to sensitive paths or network requests to external domains are present.
• Obfuscation: No Base64, zero-width characters, homoglyphs, or other obfuscation techniques were found.
• Unverifiable Dependencies: The skill does not instruct the agent to install any external dependencies. The Python imports in the template are placeholders for the user's application structure, not dependencies for the skill's own operation.
• Privilege Escalation: No sudo, chmod, or other privilege escalation commands are present.
• Persistence Mechanisms: No attempts to modify shell configurations, create cron jobs, or establish other persistence mechanisms were found.
• Metadata Poisoning: The name and description in SKILL.md are benign.
• Indirect Prompt Injection: Not applicable, as the skill provides a template and does not process external user-supplied content in a way that could lead to indirect injection.
• Time-Delayed / Conditional Attacks: No conditional logic based on time, usage, or environment variables was detected.

Conclusion: The skill is a template provider and does not execute any code or perform any operations that could pose a security risk. It is categorized as NO_CODE because the agent itself does not execute any scripts or external resources.