skills.rest
salmanabdurrahman
salmanabdurrahmanCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

framework-fastapi

Audit FastAPI security posture via OpenAPI schema and authentication checks.

Updated Jul 30, 2026
Search Tags:#security#pydantic#fastapi#openapi#ssrf#api-review
One-click install
npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill framework-fastapi
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: framework-fastapi
Source: https://github.com/salmanabdurrahman/pi-pentest-agent/tree/main/skills/framework-fastapi
Command: npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill framework-fastapi

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the challenge of identifying security misconfigurations and common vulnerabilities in FastAPI applications without requiring manual code audits or active exploitation.

Core Features & Use Cases

  • Surface Exposure Analysis: Automatically detects publicly exposed OpenAPI schemas and interactive documentation (Swagger/ReDoc) that may leak internal API details.
  • Security Posture Review: Validates authentication dependency implementation, Pydantic type-coercion risks, and potential SSRF vectors in URL-typed parameters.
  • Use Case: Use this skill during a security assessment to quickly verify if a production FastAPI service has disabled interactive docs and correctly implemented authentication on sensitive endpoints.

Quick Start

Use the framework-fastapi skill to perform a read-only security review of the target application at the provided URL.

Frequently Asked Questions about framework-fastapi

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check my FastAPI application for SSRF and security misconfigurations?▼

To check FastAPI applications for SSRF and security misconfigurations, perform a read-only security review auditing URL-typed parameters, CORS settings, and authentication dependencies without active exploitation or manual code audits.

What is the risk of leaving OpenAPI schema exposure enabled in production FastAPI?▼

Leaving OpenAPI schema exposure enabled in FastAPI risks leaking internal API details through publicly accessible interactive documentation like Swagger or ReDoc, allowing attackers to map endpoints and identify unauthenticated surfaces.

Does Pydantic validation logic introduce security risks in FastAPI endpoints?▼

Pydantic validation logic can introduce security risks in FastAPI through type-coercion vulnerabilities where unexpected data types are processed, requiring an audit of validation implementation to identify potential bypass vectors.

Can I perform a non-destructive security assessment on a live FastAPI service?▼

You can perform a non-destructive security assessment on a live FastAPI service using a read-only review that analyzes endpoint configurations and schema exposure without sending active exploit payloads or modifying server state.

How do I verify if authentication dependencies are correctly implemented on sensitive FastAPI endpoints?▼

To verify authentication dependencies on sensitive FastAPI endpoints, conduct a security posture review validating dependency implementation across routes to identify unprotected paths and information disclosure risks.

Related Skills

Explore More Software Engineering Skills→
sayalinvidiasayalinvidia

vss-query-analytics

Query VA-MCP video analytics incidents, metrics, and sensor data read-only.

Community
Advanced
sseshachalasseshachala

hunt-api-misconfig

Detect API misconfigurations and abuse vectors in REST and GraphQL services.

Community
Advanced
Renzo-TognellaRenzo-Tognella

implementing-api-schema-validation-security

Implement API schema validation with OpenAPI and JSON Schema to prevent injection and mass assignment.

Community
Advanced
balsm-healthbalsm-health
2

exploiting-idor-vulnerabilities

Identify Insecure Direct Object Reference vulnerabilities in APIs by manipulating object identifiers.

Official
Advanced