Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add jiushiwon/wg-skills --skill fastapi-agent-module-skillgit clone --depth 1 https://github.com/jiushiwon/wg-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jiushiwon/wg-skills/fastapi-agent-module-skill)<a href="https://agentmods.dev/skills/jiushiwon/wg-skills/fastapi-agent-module-skill"><img src="https://agentmods.dev/badge/skills/jiushiwon/wg-skills/fastapi-agent-module-skill/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jiushiwon/wg-skills/fastapi-agent-module-skill"><img src="https://agentmods.dev/badge/skills/jiushiwon/wg-skills/fastapi-agent-module-skill.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 257 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- medium MCP Rug Pull · line 97 Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.Fix: Pin the image: image:tag or image@sha256:abc123
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00120 | $0.05329 |
| Opus 5 | $0.00060 | $0.02665 |
| Sonnet 5 | $0.00024 | $0.01066 |
| Haiku 4.5 | $0.00012 | $0.00533 |
Grade A, and why
fastapi-agent-module-skill scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 427 lines — stays where its author put it; the contents beside it link to each section on GitHub.
FastAPI Agent Module Skill
为 FastAPI 项目叠加一套 AI Agent 能力，基于 LangGraph 框架实现。
定位
- 目标：在已有
fastapi-init-skill骨架 +fastapi-auth-module-skill鉴权模块上，添加 AI Agent 对话能力。 - 核心：LangGraph 工作流 + Tool 扩展 + 模型接入 + 上下文记忆 + 安全防护。
- 输出：Agent 核心、Tool 定义、路由、数据库模型、接口契约、测试用例。
骨架依赖
本模块依赖
fastapi-init-skill骨架 +fastapi-auth-module-skill鉴权模块。
使用前必须满足：
- ✅ 已安装
fastapi-init-skill（项目骨架） - ✅ 已安装
fastapi-auth-module-skill（用户鉴权） - ✅ 骨架包含：JWT、统一响应（EnvelopeRoute）、SQLModel、分页、异常处理（BusinessException）
对接规范（必须遵循）：
- ✅ 使用骨架的
app.config.settings配置系统，不单独定义配置 - ✅ 使用骨架的
app.response.EnvelopeRoute统一响应 - ✅ 使用骨架的
app.exceptions.BusinessException异常处理 - ✅ 使用骨架的
settings.db_prefix表前缀 - ✅ 使用骨架的
database.get_session数据库连接 - ✅ 使用骨架的
auth.dependencies.get_current_user鉴权 - ✅ lifespan 中初始化
AgentContainer，通过app.state.agent注入
用户问题（最多 3 个）
1. 用什么模型？（默认 OpenAI gpt-4o-mini，可选 Claude/Anthropic/本地模型）
2. 需要哪些内置 Tool？（默认：查用户信息、查角色、查菜单、查组织）
3. 是否开启历史消息？（默认开启，保留 20 轮）
核心能力清单
| # | 能力 | 说明 |
|---|---|---|
| 1 | LangGraph Agent | 基于 LangGraph 的对话 Agent，支持节点扩展 |
| 2 | Tool 系统 | 声明式 Tool 定义，Pydantic 参数校验，自动权限注入 |
| 3 | 模型接入 | 统一模型接口，支持 OpenAI/Claude，tenacity 退避重试 |
| 4 | 多轮对话 | 支持上下文记忆，会话级别历史，LRU 内存缓冲 |
| 5 | 对话管理 | 创建/查询/删除/清除会话 |
| 6 | 租户隔离 | org_tools 全部按 tenant 过滤，多租户安全 |
| 7 | 流式输出 | SSE 流式返回 token，含断连检测 + 代理缓冲禁用 |
| 8 | Rate Limiting | slowapi 实现，每用户 10 次/分钟（防 LLM 财务风险） |
| 9 | 审计日志 | 结构化审计 logger，记录 user/tool/token/失败事件 |
| 10 | 异常脱敏 | 客户端仅收到固定话术，真实异常写入服务端日志 |
| 11 | 数据库索引 | migration 自动创建关键索引（user_id / session_id / created_at） |
| 12 | 事务一致性 | chat() 单事务写入用户/助手消息，无幽灵消息 |
| 13 | 测试基建 | tests/ 目录提供 20+ 安全/一致性/性能测试 |
内置 Tools（全部带 current_user_id 强制注入）
| Tool | 功能 | 参数 | 权限 |
|---|---|---|---|
get_user_info |
查询当前用户基本信息（脱敏） | current_user_id（系统注入） | 仅查自己 |
get_user_roles |
查询当前用户角色 | current_user_id（系统注入） | 仅查自己 |
get_user_menus |
查询当前用户菜单 | current_user_id（系统注入） | 仅查自己 |
search_users |
搜索用户（脱敏：ID/用户名/昵称） | keyword?, limit ∈ [1,50] | 限流 |
get_org_tree |
查询当前租户组织架构树 | current_user_id | 租户隔离 |
get_org_detail |
查询当前租户部门详情 | org_id, current_user_id | 租户隔离 |
get_post_list |
查询当前租户岗位（分页） | current_user_id, status?, page?, page_size ∈ [1,50] | 租户隔离 |
get_tenant_info |
查询当前用户所属租户 | current_user_id | 仅查自己 |
safe_read_file |
读取项目内受限文本文件（编程助手） | path, max_size?, current_user_id | 路径白名单 + 大小限制 + UTF-8 + 审计 |
safe_write_file |
写入项目内文件（编程助手） | path, new_content, confirm, current_user_id | diff 预览 + 路径白名单 + 大小限制 + 审计 |
What ships with it
45 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- api-contract-agent.md 5.8 KB
- README.md 3.9 KB
- references/__init__.py 1.2 KB runs code
- references/audit.py 3.3 KB runs code
- references/config.py 951 B runs code
- references/database.py 1021 B runs code
- references/dependencies.py 352 B runs code
- references/graph/__init__.py 533 B runs code
- references/graph/agent.py 7.2 KB runs code
- references/graph/nodes.py 5.9 KB runs code
- references/graph/state.py 638 B runs code
- references/llm/__init__.py 266 B runs code
- references/llm/anthropic.py 4.8 KB runs code
- references/llm/base.py 1.6 KB runs code
- references/llm/openai.py 4.1 KB runs code
- references/memory/__init__.py 185 B runs code
- references/memory/buffer.py 3.1 KB runs code
- references/memory/store.py 3.5 KB runs code
- references/migration.py 3.9 KB runs code
- references/models.py 1.9 KB runs code
- references/pii.py 4.2 KB runs code
- references/rate_limiter.py 3.6 KB runs code
- references/routers/__init__.py 108 B runs code
- references/routers/chat.py 2.7 KB runs code
- references/routers/session.py 3.4 KB runs code
- references/routers/tools.py 753 B runs code
- references/schemas.py 2.8 KB runs code
- references/security_headers.py 1.5 KB runs code
- references/services/__init__.py 181 B runs code
- references/services/chat_service.py 9.8 KB runs code
- references/services/session_service.py 6.2 KB runs code
- references/tools/__init__.py 152 B runs code
- references/tools/base.py 9.3 KB runs code
- references/tools/file_tools.py 8.4 KB runs code
- references/tools/org_tools.py 3.8 KB runs code
- references/tools/registry.py 2.8 KB runs code
- references/tools/user_tools.py 3.1 KB runs code
- references/trace.py 2.6 KB runs code
- requirements-agent.txt 900 B
- tests/__init__.py 15 B runs code
- tests/test_file_tools.py 8.3 KB runs code
- tests/test_message_security.py 8.1 KB runs code
- tests/test_p1_fixes.py 8.6 KB runs code
- tests/test_p2_fixes.py 6.7 KB runs code
- tests/test_tool_validation.py 5.3 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 427 lines · 120 tokens per session scan A 77bc3bf94c15
fastapi-agent-module-skill is a skill published in the GitHub repository jiushiwon/wg-skills (97 stars, last pushed 2d ago), licensed Apache-2.0. It adds 120 tokens to every session and 5,329 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
mem0-oss-to-platform
Plan and then execute a migration of a project from the mem0 open-source / self-hosted SDK (the local Memory class) to the mem0 Platform / hosted / managed SDK (the MemoryClient class). Use this whenever a developer wants to move, switch, or migrate their mem0 usage off OSS/self-hosted to the hosted API — e.g.…
agui-dotnet-protobuf
Use the protobuf wire transport (instead of the default Server-Sent Events) for an AG-UI connection with the AG-UI .NET SDK — a compact binary event stream negotiated via the Accept header. USE FOR: making an AGUIChatClient prefer protobuf by wiring an AGUIEventStreamHandler with ProtobufEventStreamFormatter (then…
azure-mgmt-botservice-dotnet
Azure Resource Manager SDK for Bot Service in .NET. Management plane operations for creating and managing Azure Bot resources, channels (Teams, DirectLine, Slack), and connection settings. Triggers: "Bot Service", "BotResource", "Azure Bot", "DirectLine channel", "Teams channel", "bot management .NET", "create bot".
fastapi-router-py
Create FastAPI routers with CRUD operations, authentication dependencies, and proper response models. Use when building REST API endpoints, creating new routes, implementing CRUD operations, or adding authenticated endpoints in FastAPI applications.
migrate-segw-to-rap
Reverse-engineer a SEGW-built OData V2 service (MPC/DPC/MPCEXT/DPCEXT) into a modern RAP V4 service — tables, CDS views (interface + projection), behavior definitions, draft entities, service definition + binding. Use when asked to "migrate this SEGW service to RAP", "convert OData V2 to V4 RAP", "modernize this…
telnyx-messaging-hosted-curl
Set up hosted SMS numbers, toll-free verification, and RCS messaging. Use when migrating numbers or enabling rich messaging features. This skill provides REST API (curl) examples.