Verified:GitHub

security-checklist

Name: security-checklist
Availability: InStock
Author: cathayrisk

Provide a security review checklist for Python code handling secrets, authentication, file I/O, network requests, and user input.

Updated Apr 20, 2025

Search Tags:#security #python #secrets #input-validation #sql-injection #code-review #file-upload

Ready to run

npx skills add https://github.com/cathayrisk/Anya --skill security-checklist-cathayrisk

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-checklist
Source: https://github.com/cathayrisk/Anya/tree/main/skills/security-checklist
Command: npx skills add https://github.com/cathayrisk/Anya --skill security-checklist-cathayrisk

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Provides a concise, actionable security review checklist and secure coding patterns to prevent common vulnerabilities when Python code handles secrets, authentication, file I/O, network requests, database access, or user-supplied input.

Core Features & Use Cases

Secrets Management: Guidance to keep API keys and credentials out of source code and use environment variables or secret stores.
Injection & Validation: Rules for parameterized SQL, input validation, and avoiding eval/exec to prevent injection and remote code execution.
Safe I/O & Network: Patterns to prevent path traversal, validate uploads, enforce size/type limits, and make safe HTTP requests with SSL and timeouts.
Use Case: Ideal for code reviews, CI pre-merge checks, implementing login flows, handling file uploads, and auditing integrations with external APIs.

Quick Start

Use the security-checklist to audit any Python module that accesses databases, files, networks, or user input and list required fixes and mitigations.

Frequently Asked Questions about security-checklist

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I prevent SQL injection and path traversal in Python code reviews?▼

To prevent SQL injection and path traversal in Python code reviews, enforce parameterized SQL queries, apply input validation, and implement path traversal guards for file I/O operations. This stops injection attacks and unauthorized file access during CI pre-merge checks.

What is the best way to manage API keys and secrets in Python applications?▼

The best way to manage API keys and secrets in Python applications is enforcing environment-based secret management. Keep credentials entirely out of source code by using environment variables or dedicated secret stores to prevent accidental exposure.

How do I secure file uploads and network requests in Python?▼

To secure file uploads and network requests in Python, enforce strict upload type and size limits, validate uploaded files, and configure safe HTTP requests with SSL verification and explicit timeouts to prevent unauthorized access and hanging connections.

Why should I avoid eval and exec in Python code, and how do I check for it?▼

You should avoid eval and exec in Python code because they allow remote code execution through user-supplied input. Check for them during code reviews to ensure dynamic execution is eliminated and safe input validation patterns are applied instead.

Can this security checklist be used for auditing Python API integrations and login flows?▼

Yes, this security checklist can be used for auditing Python API integrations and login flows. It specifically targets authentication implementations and external API integrations to identify improper secret handling and injection vulnerabilities.