fastapi-api-patterns
Warn
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- Dynamic Execution (MEDIUM): The script
scripts/generate-openapi-docs.shusesimportlib.import_moduleandgetattrto load a FastAPI application from a module path provided as a command-line argument. This allows for arbitrary code execution during the module import phase if the script is directed to process an untrusted or malicious module. - Indirect Prompt Injection (MEDIUM): The skill exhibits an attack surface (Category 8) because
scripts/validate-endpoints.shandscripts/generate-openapi-docs.shingest untrusted data from files provided as arguments (Ingestion points:$1filename argument in both scripts). There are no boundary markers or sanitization routines present to prevent malicious content in those files from influencing script output or agent reasoning (Boundary/Sanitization: Absent). The scripts possess significant system capabilities including Python execution and shell command processing (Capability inventory: subprocess calls, import_module, grep, sed). - External Downloads (LOW): The
scripts/generate-openapi-docs.shscript generates HTML documentation that includes remote script and stylesheet links tocdn.jsdelivr.net. While these are standard Swagger UI libraries, they represent a reliance on external third-party assets.
Audit Metadata