api-scaffolding
Facilitates rapid development of production-ready FastAPI endpoints for client workflows, including integrations with QuickBooks and Stripe.
Install this skill
Security score
The api-scaffolding skill was audited on May 13, 2026 and we found 17 security issues across 3 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Webhook reference - potential data exfiltration
| 3 | description: Scaffold production-ready FastAPI endpoints for any client workflow. Use this skill ANY TIME the user wants to create a new API, add an endpoint, build a server, set up a webhook receiver |
Webhook reference - potential data exfiltration
| 26 | - [ ] **What are the inputs?** (form fields, webhook payload, query params) |
Webhook reference - potential data exfiltration
| 37 | | A webhook receiver (Stripe, ShipStation) | [Webhook Receiver](#common-endpoint-patterns) | |
Webhook reference - potential data exfiltration
| 125 | from .api import invoices, webhooks, inventory |
Webhook reference - potential data exfiltration
| 133 | app.include_router(webhooks.router, prefix="/api/v1") |
Webhook reference - potential data exfiltration
| 143 | ### Webhook Receiver |
Webhook reference - potential data exfiltration
| 145 | # execution/api/webhooks.py |
Webhook reference - potential data exfiltration
| 150 | router = APIRouter(prefix="/webhooks", tags=["webhooks"]) |
Webhook reference - potential data exfiltration
| 153 | async def stripe_webhook( |
Webhook reference - potential data exfiltration
| 157 | """Handle Stripe webhook events.""" |
Webhook reference - potential data exfiltration
| 162 | event = stripe.Webhook.construct_event( |
Webhook reference - potential data exfiltration
| 163 | payload, stripe_signature, WEBHOOK_SECRET |
Webhook reference - potential data exfiltration
| 269 | │ ├── webhooks.py # Webhook receivers |
Access to .env file
| 281 | ├── config.py # Settings from .env |
Access to .env file
| 318 | - [ ] Secrets are in `.env`, never hardcoded |
Access to .env file
| 323 | - [ ] `.env.example` documents every required key |
External URL reference
| 308 | open http://localhost:8000/docs |