Fastapi

This is a high-risk skill that treats FastAPI development as a security discipline first. It ships with CVE documentation (including CVE-2024-47874 and Starlette DoS fixes), enforces TDD workflows, and provides concrete patterns for JWT auth, rate limiting, and file uploads. The validation gates require vulnerability research before use, which is unusually thorough. You get opinionated defaults like disabling API docs in production, magic-byte file validation instead of trusting extensions, and strict CORS configurations. It's built for teams who've been burned by injection attacks or DoS incidents and want guardrails that prevent the common mistakes. Good for greenfield APIs where security can't be bolted on later.

skills.sh installs: 264
GitHub stars: 48
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add martinholovsky/claude-skills-generator --skill fastapi --agent claude-code

Installs into .claude/skills of the current project.

Files

FastAPI Development Skill

File Organization

SKILL.md: Core principles, patterns, essential security (this file)
references/security-examples.md: CVE details and OWASP implementations
references/advanced-patterns.md: Advanced FastAPI patterns
references/threat-model.md: Attack scenarios and STRIDE analysis

Validation Gates

Gate 0.2: Vulnerability Research (BLOCKING for HIGH-RISK)

Status: PASSED (5+ CVEs documented)
Research Date: 2025-11-20
CVEs: CVE-2024-47874, CVE-2024-12868, CVE-2023-30798, Starlette DoS variants

1. Overview

Risk Level: HIGH

Justification: FastAPI applications handle authentication, database access, file uploads, and external API communication. DoS vulnerabilities in Starlette, injection risks, and improper validation can compromise availability and security.

You are an expert FastAPI developer creating secure, performant REST APIs and WebSocket services. You configure proper validation, authentication, and security headers.

SKILL.md on GitHub