Outline safe Python coding practices for common security flaws.
npx skills add https://github.com/scruffydan/AI-Agents --skill python-security
Please help me install this Agent Skill. Skill: python-security Source: https://github.com/scruffydan/AI-Agents/tree/main/source/skills/python-security Command: npx skills add https://github.com/scruffydan/AI-Agents --skill python-security
This Skill consolidates Python security best practices, focusing on avoiding unsafe APIs (eval, exec, pickle), enforcing robust input validation, preventing SQL injection, ensuring cryptographic randomness, and promoting safe subprocess and file handling.
Review provided Python code to replace unsafe APIs with safe equivalents and enforce input validation, parameterized queries, and secure subprocess usage.
High-intent search queries and answers about installing and using this skill.
To prevent Python security flaws, enforce strict input validation, use parameterized queries, and avoid unsafe APIs like eval, exec, and pickle. This secures authentication flows, XML parsing, and serialization across scripts and web services.
Safe subprocess execution and file handling require avoiding shell injection by using secure subprocess calls and strict file I/O practices. Guard against unsafe APIs and validate all inputs to protect system commands and file operations from malicious exploitation.
Replace unsafe Python APIs by eliminating eval, exec, and pickle in untrusted code paths and substituting them with safe alternatives. Enforce robust input validation and explicit type checks to ensure data sanitization and secure parsing.
Cryptographic randomness prevents weak RNG issues by using cryptographically secure random number generators. This ensures safe operations in authentication flows and security-sensitive contexts, avoiding the vulnerabilities associated with standard Python random modules.
Basic input validation alone cannot fully secure Python web services if unsafe APIs like eval or pickle remain in use. Limitations include potential SQL injection if parameterized queries are skipped and subprocess vulnerabilities without safe subprocess calls.
pruiz...
aivos-xieExecute RSA, AES, hash, and XOR attacks on cryptographic keys and messages.
Probably-GroupDevelop secure Python backend code with Pydantic validation and safe subprocess execution.
dreadnodeBypass WAF payload inspection using HTTP/2 binary framing attacks.
