A SECRET_KEY written in main.py lets anyone forge tokens; verify_signature False lets anyone pick their own user ID. This skill finds those and nine other FastAPI mistakes before you deploy, and tells you how to fix each one.

Your agent runs a scanner on your Python files. It reads Python with Python's own parser, follows route and query parameters through your code, and knows the safe patterns: settings read from the environment, Pydantic settings without defaults, bound SQL parameters, passlib with bcrypt or argon2, and os.path.basename. It never runs your app. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• A01: a hard-coded secret key, JWT key, password, token or API key

• A02: jwt.decode without signature checks, or the none algorithm

• A03: SQL built with f-strings, %, .format() or + and run with execute or text()

• A04: CORS with (or .) and allow_credentials=True

REVIEW (check before release)

• A11: /docs and /openapi.json left public (FastAPI() without docs_url or openapi_url)

• A12: debug=True or uvicorn reload=True

• A13: md5, sha1 or sha256 on passwords, weak CryptContext schemes, or passwords compared with ==

• A14: JWTs created without an exp claim

• A15: file paths from route or query parameters

• A16: TrustedHostMiddleware with allowed_hosts ['*']

• A17: exception text or tracebacks sent in responses

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• A risky and a safe example FastAPI app, and the real report the scanner produces on the risky one

Limits

It follows values within one file. Dependencies, your ASGI server, reverse proxy and authentication logic spread across files are not checked. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 12 files: SKILL.md, the scanner in scripts/ (2 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (7 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.