FastAPI Flask Proxy

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:19 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent FastAPI/Flask deployment guide, but it presents an internal backend as publicly exposed and includes a real internal user/host/path reference.

Review before installing or using as a template. Treat its proxy pattern as local-development guidance only unless you change the backend to bind privately, avoid publishing the FastAPI port, and add authentication/authorization for state-changing endpoints. Remove the internal project reference from published copies.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:210

Finding

Backend API Exposed Beyond the Required Proxy Boundary

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 193 and 210–212
Vulnerability Type: Excessive network exposure and insecure deployment configuration
Risk Level: Medium

Vulnerable Code

bash

# Start FastAPI backend in the background
cd /app
python -m uvicorn api:app --host 0.0.0.0 --port 18000 &
FASTAPI_PID=$!

yaml

version: '3.8'
services:
  api:
    build: .
    command: python -m uvicorn api:app --host 0.0.0.0 --port 18000
    ports:
      - "18000:18000"

Similar all-interface bindings also appear in the example code at lines 51 and 72.

Technical Analysis

The documented architecture designates Flask as the public frontend and API proxy, with FastAPI acting as an internal backend. Binding FastAPI to 0.0.0.0 makes it listen on every available network interface. The Docker Compose configuration additionally publishes port 18000 on the host.

Publishing the backend contradicts the stated internal-proxy architecture and exceeds the minimum network privileges required for same-host or private-container communication. External clients may connect directly to FastAPI, bypassing any authentication, validation, rate limiting, logging, origin controls, or other policy enforced by Flask.

The guide does not demonstrate API authentication, TLS, firewall restrictions, trusted-host validation, or access controls that would compensate for this exposure. Although this is documentation rather than an active deployment, users following it may reproduce the insecure configuration.

Attack Path

1. A user deploys the documented configuration on a host reachable by an untrusted network.
2. The FastAPI process listens on all interfaces, and Docker or the host publishes TCP port 18000.
3. An attacker discovers the exposed port through network scanning or deployment metadata.
4. The attacker sends requests directly to http://HOST:18000/api/..., avoiding the Flask p ...[truncated 1048 chars]

Remediation

View remediation

Remediation Suggestions

1. For same-host deployment, bind FastAPI only to loopback:

   bash

   python -m uvicorn api:app --host 127.0.0.1 --port 18000
   

2. For Docker Compose, do not publish the API port on the host. Use the private Compose network:

   yaml

   services:
     api:
       build: .
       command: python -m uvicorn api:app --host 0.0.0.0 --port 18000
       expose:
         - "18000"
   
     web:
       build: .
       environment:
         - FASTAPI_URL=http://api:18000
   

   Listening on 0.0.0.0 inside the API container is acceptable when the container port is not published and network policy restricts access to the frontend service.

3. Enforce authentication and authorization within FastAPI itself rather than relying exclusively on the proxy.

4. Require TLS for traffic crossing an untrusted network.

5. Add firewall, security-group, or container-network rules that permit backend access only from the proxy.

6. Apply rate limiting, request-size limits, timeouts, and audit logging at both the proxy and backend layers.

7. Document that backend ports must not be publicly exposed unless direct API access is an explicit, secured requirement.

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:235

Finding

Internal Infrastructure and User Information Disclosure

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 235
Vulnerability Type: Internal infrastructure information disclosure
Risk Level: Low

Vulnerable Code

text

- Preference Alignment System: `[e-mail]:/data/algorithm/user/wphu/OmniMLLM/preference-align`

Technical Analysis

The Skill publishes a specific username, organizational hostname, internal project name, and absolute filesystem path. These details are unrelated to the generic FastAPI and Flask deployment guidance and are not required for its declared functionality.

The information is not a password or private key, but it reveals useful environmental structure:

• A potentially valid account identifier: wphu
• A specific organizational host: gpu506.aibee.cn
• The likely purpose of the system through its GPU-oriented hostname
• An absolute user and project path
• Internal project naming and directory conventions

This data can improve an attacker's reconnaissance and make targeted phishing, credential attacks, host enumeration, and path guessing more credible and efficient.

Attack Path

1. An attacker obtains or views the published Skill.
2. The attacker extracts the username, hostname, project name, and filesystem path.
3. The attacker checks whether the disclosed hostname is externally resolvable or reachable.
4. The attacker targets the identified user and host with phishing, credential stuffing, SSH access attempts, or organization-specific social engineering.
5. If another vulnerability later provides file or command access, the disclosed absolute path helps the attacker locate the named project directly.

This disclosure is reconnaissance data and does not independently grant system access. Further weaknesses, such as exposed remote services or compromised credentials, would be necessary to obtain privileges.

Impact Assessment

The immediate impact is loss of infrastructure confidentiality. A ...[truncated 410 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the internal project reference because it is unnecessary for the Skill's functionality.

2. If a related-project example is needed, replace all organization-specific values with unambiguous placeholders:

   text

   - Example project: `user@example-host:/path/to/example-project`
   

3. Review the repository history and other published documentation for similar usernames, internal hostnames, IP addresses, filesystem paths, and project identifiers.

4. If the hostname or account is externally accessible, confirm that strong authentication, access restrictions, and monitoring are enabled.

5. Establish a publication review process that detects internal domains, user paths, credentials, and other environment-specific data before release.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

md

# 代理 POST 请求
@app.route("/api/<path:path>", methods=["POST"])
def proxy_post(path):
    resp = requests.post(f"{FASTAPI_BASE}/api/{path}", 
                        json=request.get_json())
    return Response(resp.content, status=resp.status_code,
                   headers={"Content-Type": "application/json"})

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md

# 代理 PUT 请求
@app.route("/api/<path:path>", methods=["PUT"])
def proxy_put(path):
    resp = requests.put(f"{FASTAPI_BASE}/api/{path}", 
                       json=request.get_json())
    return Response(resp.content, status=resp.status_code,
                   headers={"Content-Type": "application/json"})

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file documents cascade deletion and manual deletion of records and returns a success status, but it does not warn that the operation permanently removes primary and related records. For markdown files, omissions of warnings around behaviors affecting user data should be flagged when the description presents the behavior as a recommended solution without cautionary language.

Content

No source excerpt is available for this finding.