FastAPI

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:42 PM UTC
• Version: 1.0.1

Overview

This is a documentation-only FastAPI guidance skill with disclosed local preference storage and no evidence of hidden execution or credential access.

Safe to install for FastAPI coding assistance. Expect it to use a small local preference file under ~/Clawic/data/fastapi/config.yaml and to guide edits to FastAPI project code when invoked; review generated app-specific code and dependency choices before applying them in production.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · auth.md (reported line 42)May include surrounding context.

md

| Signature key source | Fetch JWKS once at startup or cache it with a TTL; fetching per request adds an upstream to every call and a new failure mode |
| `sub` shape | Treat it as an opaque string; casting to int breaks the day the provider issues UUIDs |

- Access tokens short (minutes), refresh tokens long and revocable. Revocation needs state — a deny list in Redis keyed by `jti`, or a `token_version` column compared on each request; a stateless JWT cannot be un-issued.
- Symmetric (HS256) is fine when the same service signs and verifies; asymmetric (RS256/EdDSA) once anything else must verify, so the private key never leaves the issuer.

## Passwords

Cloud Metadata Access

High

• Category: Server-Side Request Forgery
• Confidence: 90% confidence

Finding

Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.

Content

Scanner excerpt · security.md (reported line 28)May include surrounding context.

md

| Filesystem | Never join user input into a path: generate your own key, or resolve and verify the result is inside the base directory (`..%2f` survives naive checks) |
| Archives | Zip entries can contain `../` paths and symlinks; validate every member before extracting |
| Deserialization | JSON only; `pickle` of client data executes code |
| URLs you fetch (SSRF) | Allowlist hosts, resolve the DNS name and reject private ranges and `169.254.169.254`, disable redirects or re-validate after each hop |
| HTML rendering | Autoescaping on; never `\| safe` on user content (`templates.md`) |
| Regex on user input | A catastrophic pattern turns one request into 100% CPU; bound input length and avoid nested quantifiers |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · settings.md (reported line 16)May include surrounding context.

md

class Settings(BaseSettings):
    model_config = SettingsConfigDict(
        env_file=".env", env_prefix="APP_", env_nested_delimiter="__", extra="ignore"
    )
    environment: str = "local"
    database_url: str

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · settings.md (reported line 36)May include surrounding context.

md

## Precedence and Naming

Highest to lowest: init arguments → environment variables → `.env` file → secrets directory → field default. A value present in the process environment always beats `.env`, which is why a stale exported variable in a shell explains "the .env change did nothing".

- `env_prefix="APP_"` means the field `database_url` reads `APP_DATABASE_URL`. Field names are matched case-insensitively.
- Nested models read `APP_REDIS__HOST` with `env_nested_delimiter="__"`; without the delimiter the nested field is invisible and falls back to its default silently.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.

md

- **Tooling**: package and env manager (pip, uv, poetry), linter and formatter, migration tool, load generator — affects every command block shown alongside code
- **Conventions**: router and module naming, schema suffixes (`Create`/`Read`/`Update`), URL casing, versioning scheme, docstring style — affects generated routers and models (`structure.md`)
- **Platform**: cloud, reverse proxy, Python version, CPU count, managed database — affects worker maths, proxy headers, and pool sizing (`deployment.md`)
- **Safety posture**: how loudly to flag missing auth, unbounded uploads, absent timeouts, `verify=False`, secrets in logs — affects review comments, never the correctness rules
- **Integrations**: cache, broker, and object store of choice (Redis, RabbitMQ, S3-compatible), auth provider, error tracker — affects which client patterns appear
- **Output format**: whole file vs minimal diff, how much explanation, whether tests and migrations accompany every change
- **Work order**: contract-first (OpenAPI or schema before handlers) vs code-first, migration before or after model change, review gates before edits — affects sequence, never correctness

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · auth.md (reported line 26)May include surrounding context.

CurrentUser = Annotated[User, Depends(get_current_user)]

text

- 401 means "no valid identity", 403 means "identity known, not allowed". Returning 403 for an expired token makes clients retry forever instead of refreshing.
- `WWW-Authenticate: Bearer` on the 401 is what tells a compliant client to re-authenticate.
- One dependency for authentication, separate ones for authorization: `CurrentUser` proves who; `require_role("admin")` decides what.

Unbounded Output

Medium

• Category: Output Handling
• Confidence: 60% confidence

Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · testing.md (reported line 52)May include surrounding context.

Database Isolation

Rollback-per-test, one real database, no truncation between tests:

python

@pytest_asyncio.fixture

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: templates.md:34