skills.rest
asarchami
asarchamiCOMMUNITY
Explore all skills by this author →
GitHub

python-security

Audits Python projects for vulnerabilities using Bandit, pip-audit, Semgrep, and detect-secrets.

1|2|Updated Nov 25, 2017
Search Tags:#python#security audit#detect-secrets#vulnerability scanning#bandit#pip-audit#ci security
One-click install
npx skills add https://github.com/asarchami/dotfiles --skill python-security-asarchami
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: python-security
Source: https://github.com/asarchami/dotfiles/tree/main/dot_config/opencode/skills/python/security
Command: npx skills add https://github.com/asarchami/dotfiles --skill python-security-asarchami

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires bandit, pip-audit, semgrep, detect-secrets.

What problem does it solve? Python codebases often contain hidden security flaws like SQL injection, command injection, hardcoded credentials, and vulnerable dependencies that go unnoticed until exploited. This Skill provides a structured auditing workflow that detects these issues with industry-standard scanners and gives concrete remediation patterns. ## Core Features & Use Cases - Static Analysis: Run Bandit to flag high-severity issues such as shell=True subprocess calls, weak cryptography (MD5/SHA1), and unsafe pickle deserialization. - Dependency & Secrets Scanning: Use pip-audit for known dependency vulnerabilities and detect-secrets to catch leaked API keys and credentials. - CI Integration: Add security scanning to GitHub Actions so every pull request and weekly dependency check runs automatically. - Use Case: Before merging a pull request, run the audit checklist to confirm parameterized SQL queries, validated file paths, and a clean pip-audit report. ## Quick Start Audit my Python project for security vulnerabilities and report any high-severity findings with fixes.

Frequently Asked Questions about python-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan Python code for security vulnerabilities?▼

Run Bandit with 'bandit -r src/ -ll' to report only high-severity findings in your source tree. Combine it with pip-audit for dependency vulnerabilities and detect-secrets to catch leaked credentials.

How to detect hardcoded secrets in a Python repository?▼

Use detect-secrets to scan the codebase and generate a baseline file with 'detect-secrets scan > .secrets.baseline'. Bandit also flags hardcoded passwords via rules B105 and B106, which should be replaced with environment variables.

What does Bandit flag in Python code?▼

Bandit flags SQL injection (B608), command injection from shell=True (B602), hardcoded secrets (B105/B106), weak cryptography like MD5 (B303), unsafe pickle usage (B301), and path traversal risks (B108).

Can I run Python security scans in GitHub Actions CI?▼

Yes, add steps running 'bandit -r src/ -ll', 'pip-audit', and 'detect-secrets scan --all-files' to a workflow file. This scans every pull request, and you can schedule weekly dependency scans.

How do I fix SQL injection findings in Python?▼

Replace string-formatted queries with parameterized queries, such as conn.execute("SELECT * FROM users WHERE id = ?", (user_id,)). This prevents user input from being interpreted as SQL syntax.

Why does Bandit warn about subprocess with shell=True?▼

shell=True passes commands through the system shell, allowing injected input to execute arbitrary commands. Pass arguments as a list instead, like subprocess.run(["cat", filename], check=True), to bypass shell interpretation.

Related Skills

Explore More Software Engineering Skills→
ActiveInferenceInstituteActiveInferenceInstitute
13

geo-infer-req

Resolve Python dependency trees and manage isolated execution environments.

Community
Intermediate
Rune-kitRune-kit
82

sentinel

Scan code commits for secrets, OWASP top 10 patterns, and dependency vulnerabilities.

Official
Advanced
bismuthdigitalbismuthdigital

lint

Run ruff and mypy checks to lint and format Python code.

Official
Intermediate
LeoWSY-hashblueLeoWSY-hashblue
3

mobile-security

Analyze Android APKs and iOS IPAs for security weaknesses via static analysis.

Community
Advanced