Security audit

Fastapi Studio Template

Security checks for vulnerabilities and agentic risk

Overview

This FastAPI studio template is coherent and not malicious, but it needs review because it understates third-party browser script loading and prompt exposure risks.

Install only if you are comfortable reviewing or modifying generated apps before use. Prefer vendoring HTMX locally or adding SRI/CSP, avoid sending full prompts in URLs, and make Langfuse prompt tracing explicit, redacted, and retention-limited for any sensitive data.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:215
Finding: Third-Party Browser Scripts Loaded Without Integrity Protection<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:215-216` **Vulnerability Type**: Unprotected third-party runtime dependency **Risk Level**: High ### Vulnerable Code ```html <script src="https://unpkg.com/htmx.org@1.9.12"></script> <script src="https://unpkg.com/htmx.org@1.9.12/dist/ext/sse.js"></script> ``` ### Technical Analysis The application template loads executable JavaScript directly from the public unpkg CDN. Although a package version is specified, the resources are not protected by Subresource Integrity hashes and are not hosted as reviewed local assets. The browser consequently trusts whatever JavaScript the remote service returns at runtime. Compromise of the package publication process, the CDN, its delivery infrastructure, or the referenced package version could cause attacker-controlled JavaScript to execute in the application's origin context. This behavior also conflicts with the metadata at `SKILL.md:17-19`, which states that Langfuse tracing is the only outbound network activity. The generated browser application makes additional outbound requests to unpkg whenever the page loads. ### Attack Path 1. An attacker compromises the referenced package artifact, its publishing account, the CDN, or another part of the delivery chain. 2. The attacker modifies one of the JavaScript responses to contain a malicious browser payload. 3. A user opens an application generated from this template. 4. The browser retrieves and executes the modified script because no integrity hash verifies its contents. 5. The payload reads or modifies application content, intercepts prompts and ratings, performs authenticated same-origin requests available to the page, or exfiltrates browser-accessible data. ### Impact Assessment Successful exploitation provides JavaScript execution in the browser context of every user receiving the compromised dependency. The attacker could access prompts, generated results, ratings, DOM content, and non-`HttpOnly` b ...[truncated 428 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Download and review the required HTMX files, then serve them as version-controlled local static assets. 2. If CDN delivery is retained, use immutable URLs and add validated Subresource Integrity hashes with `integrity` and `crossorigin="anonymous"` attributes. 3. Deploy a restrictive Content Security Policy that limits `script-src` to approved local resources or explicitly hashed scripts. 4. Pin dependency versions and hashes in a reproducible dependency manifest. 5. Monitor dependency advisories and establish a controlled process for reviewing upgrades. 6. Update the Skill's network metadata to disclose all runtime outbound connections, including browser requests to unpkg. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:184
Finding: Sensitive Prompts Exposed Through Query Strings and Langfuse Telemetry<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:184-190` and `SKILL.md:240-245` **Vulnerability Type**: Sensitive information exposure through URLs and external telemetry **Risk Level**: Medium ### Vulnerable Code Langfuse receives the complete prompt as trace input: ```python langfuse = Langfuse() def generate_with_trace(prompt, model_name): trace = langfuse.trace(name="studio-generation", metadata={"model": model_name}) span = trace.span(name="generate", input={"prompt": prompt}) result = ModelRegistry.get(model_name).generate(prompt) span.end(output={"length": len(result)}) return result ``` The browser also places the complete prompt in a GET query string: ```javascript function startGeneration() { const prompt = document.getElementById('prompt').value; const progress = document.getElementById('progress'); progress.style.display = 'block'; progress.textContent = 'Starting...'; const source = new EventSource('/generate/stream?prompt=' + encodeURIComponent(prompt)); ``` ### Technical Analysis The template handles user prompts through two disclosure-prone channels. First, the prompt is included directly in the `/generate/stream` query string. Query parameters are commonly retained by application servers, reverse proxies, load balancers, observability platforms, access logs, and troubleshooting systems. URL encoding preserves transport compatibility but does not provide confidentiality. Second, `generate_with_trace` explicitly submits the complete prompt to Langfuse as trace input. The Skill also recommends logging every generation at `SKILL.md:295`, but it does not prescribe redaction, consent, access controls, retention limits, or filtering of secrets and personal information. These channels can create multiple durable copies of confidential prompts beyond the generation process itself. Exposure depends on deployment logging and Langfuse configuration, but the unsafe transmission patterns are ...[truncated 1472 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Use a `POST` request with a request body to create a generation job rather than transmitting prompts in a URL. 2. Return an opaque, random job identifier and connect the SSE client to a URL containing only that identifier. 3. Do not record complete prompts in telemetry by default. Record non-sensitive metadata such as model identifier, duration, status, and token counts instead. 4. If prompt tracing is required, make it explicitly opt-in and apply configurable redaction before telemetry submission. 5. Detect and remove common secret formats and sensitive fields before logging or tracing. 6. Apply strict role-based access control, encryption, retention limits, and audit logging to both application logs and Langfuse data. 7. Configure proxies and application servers to avoid logging sensitive query strings. 8. Clearly document the telemetry destination and obtain appropriate user consent before transmitting prompt content. ]]>

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The security note states the template generates no network traffic except optional Langfuse traces, yet the example instructs the browser to fetch JavaScript from unpkg.com. Even if the server itself does not call out, the generated application causes user clients to contact a third party, which expands exposure to tracking, CDN compromise, CSP violations, and deployment policy conflicts.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The manifest and security notes claim outbound network use is limited to optional Langfuse tracing, but the worked example includes client-side script tags loading HTMX and the SSE extension from unpkg.com. This creates additional third-party network dependencies and a supply-chain/trust risk that is not disclosed in the stated network model, which can mislead users performing security review or deploying in restricted environments.

Static analysis

No suspicious patterns detected.