Nex 1099 Contractor Pack
by Nex AI
Automated security scanner for FastAPI repos to detect secrets, SQLi, insecure CORS, and unverified webhooks.
Secure checkout via Stripe
Works with the AI tools you already use
See it in action
You say
Run a security preflight audit on my FastAPI project in the /backend folder and fail if any high-severity issues are found.
Your agent does
Scan complete for /backend. Findings:
- CRITICAL: Hardcoded Postgres URL found in config.py
- HIGH: Webhook at /api/v1/stripe missing signature verification
- HIGH: CORS allow_origins=["*"] with allow_credentials=True Result: Failed (3 high/critical issues).
What you get
About this skill
The problem
Manual security audits for FastAPI applications are slow and error-prone. Developers frequently ship code with hardcoded secrets, insecure CORS headers, or unverified webhooks that lead to production vulnerabilities.
What it does
- Scans code for hardcoded API keys, tokens, and database credentials using AST analysis.
- Detects insecure FastAPI configurations including debug mode, permissive CORS, and broad network binds.
- Identifies SQL injection risks in f-strings and unparameterized execute calls.
- Validates webhook implementations for missing HMAC or signature verification.
- Audits route handlers to ensure Pydantic models are used instead of raw JSON requests.
Frameworks & tools
FastAPI, Python 3.11+, Pydantic, Uvicorn, and SQL databases using SQLAlchemy or raw SQL drivers.
Why this beats prompting it yourself
General LLM prompts often miss subtle context-specific vulnerabilities or produce hallucinations. This skill uses deterministic AST scanning to ensure 100% coverage of your codebase without the token costs or privacy risks of sending your entire repo to an external API.
Use cases
- Running pre-deployment checks to block insecure code from hitting production.
- Auditing legacy FastAPI repositories for hidden secrets or raw SQL injections.
- Integrating into CI/CD pipelines to enforce security standards automatically.
- Ensuring webhook endpoints are properly protected by signature verification.
Known limitations
Requires Python 3.11 or higher. Scans are limited to static analysis and may not catch vulnerabilities hidden in dynamic string evaluations.
How to install
Drop the file into your AI Agent. Works with Claude, Cursor, ChatGPT, and 20+ more.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill passes our trust checks below.
Security scanned
Passed our 8-point scan before listing
Fresh listing
Recently published to Agensi
30-day refund
Not a fit? Get your money back
Trust & safety
Security scanned
Verified clean today
- 30-day refund guarantee
- One-time purchase, yours forever
- Secure checkout via Stripe
Creator
249 skills on Agensi
Founder of Nex AI. I build production-grade Claude Skills from systems that actually run: multi-tenant SaaS, Telegram agents, Raspberry Pi infrastructure, 3D multiplayer rooms. Every skill ships battle-tested patterns, not theory. 33+ open source skills published, commercial catalog growing.
Frequently Asked Questions
Popular in Security & Compliance
Bounty Security Pattern Master Library — 399 Vulnerability Patterns
A premium library of 399 vulnerability patterns and DeFi attack vectors for AI-driven bug hunting and security audits.
sast-configuration
Automate the setup and optimization of Semgrep, SonarQube, and CodeQL for high-signal security testing.
cybersecurity-bridge for all agentic
A high-performance wrapper to route security tasks directly to the Anthropic-Cybersecurity-Skills library.
skill-security-vendor-pack
Audit AI agent skills for security risks, packaging errors, and marketplace readiness with professional reports.