OverviewHistoryStatsSecurity
npx skills add ...
Documentation
SKILL.md
npx skills add igorwarzocha/opencode-workflows --skill security-fastapi
Review FastAPI security audit patterns for dependencies and middleware. Use for auditing auth dependencies, CORS configuration, and TrustedHost middleware. Use proactively when reviewing FastAPI apps. Examples: - user: "Audit FastAPI route security" → check for Depends() and Security() usage - user: "Check FastAPI CORS setup" → verify origins when allow_credentials=True - user: "Review FastAPI middleware" → check TrustedHost and HTTPSRedirect config - user: "Secure FastAPI API keys" → move from query params to header schemes - user: "Scan for FastAPI footguns" → check starlette integration and dependency order
npx skills add igorwarzocha/opencode-workflows --skill security-fastapi
Security audit patterns for FastAPI applications covering authentication dependencies, CORS configuration, and middleware security.
FastAPI expects authentication/authorization via dependencies on routes or routers. If no Depends()/Security() usage exists, review every route for unintended public access.
If using API keys, SHOULD prefer header-based schemes (APIKeyHeader) and validate the key server-side.
Using allow_origins=["*"] excludes credentialed requests (cookies/Authorization). For authenticated browser clients, MUST explicitly list allowed origins.
SHOULD use Starlette middleware to prevent host-header attacks and enforce HTTPS in production.
Depends() or Security() auth dependenciesAPIKeyHeader), not query paramsallow_origins is explicit when allow_credentials=TrueTrustedHostMiddleware configured for production domainsHTTPSRedirectMiddleware enabled in production (or enforced by proxy)scripts/scan.sh - First-pass FastAPI security scanfrom fastapi import Depends, FastAPI
from fastapi.security import APIKeyHeader
api_key = APIKeyHeader(name="x-api-key")
@app.get("/items")
async def read_items(key: str = Depends(api_key)):
return {"key": key}from fastapi.middleware.cors import CORSMiddleware
app.add_middleware(
CORSMiddleware,
allow_origins=["https://app.example.com"],
allow_credentials=True,
allow_methods=["*"],
allow_headers=["*"],
)from starlette.middleware.trustedhost import TrustedHostMiddleware
from starlette.middleware.httpsredirect import HTTPSRedirectMiddleware
app.add_middleware(TrustedHostMiddleware, allowed_hosts=["example.com", "*.example.com"])
app.add_middleware(HTTPSRedirectMiddleware)# Detect FastAPI usage
rg -n "fastapi" pyproject.toml requirements*.txt
# Find routes
rg -n "@app\.(get|post|put|patch|delete)" . -g "*.py"
# Check for auth dependencies
rg -n "Depends\(|Security\(" . -g "*.py"
# CORS config and wildcards
rg -n "CORSMiddleware|allow_origins|allow_credentials" . -g "*.py"
# TrustedHost/HTTPS middleware
rg -n "TrustedHostMiddleware|HTTPSRedirectMiddleware" . -g "*.py"