skills.rest
yhy0
yhy0COMMUNITY
Explore all skills by this author →
Website𝕏@yhy_00GitHub

vuln-patterns-deserialization

Identifies CVE-502 deserialization vulnerabilities in Python code, including untrusted sources and sinks like pickle.loads, yaml.load, torch.load, ZeroMQ, and json with hooks.

74|10|Updated Mar 5, 2026
Search Tags:#security#vulnerability#python#code audit#deserialization#cwe-502
One-click install
npx skills add https://github.com/yhy0/ghsa-skill-builder --skill vuln-patterns-deserialization
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: vuln-patterns-deserialization
Source: https://github.com/yhy0/ghsa-skill-builder/tree/main/vuln-skills/skills/vuln-patterns-deserialization
Command: npx skills add https://github.com/yhy0/ghsa-skill-builder --skill vuln-patterns-deserialization

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps identify and prevent deserialization vulnerabilities (CWE-502) in Python code, which can lead to arbitrary code execution.

Core Features & Use Cases

  • Source Identification: Detects untrusted data sources that could be used in deserialization attacks.
  • Sink Detection: Identifies dangerous deserialization functions like pickle.loads, yaml.load, torch.load, etc.
  • Sanitization Gap Analysis: Checks for missing or inadequate security measures like input validation or safe loading.
  • Use Case: When auditing a Python web application, load this Skill to automatically flag potential deserialization risks in API endpoints that accept serialized data.

Quick Start

Use the vuln-patterns-deserialization skill to audit the provided Python script for deserialization vulnerabilities.

Frequently Asked Questions about vuln-patterns-deserialization

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect deserialization vulnerabilities in Python code?▼

To detect deserialization vulnerabilities in Python code, audit untrusted data sources and dangerous sink functions like `pickle.loads`, `yaml.load`, and `torch.load` for missing sanitization. This identifies CWE-502 risks by analyzing code paths for unsafe loading mechanisms.

What causes deserialization vulnerabilities in Python applications?▼

Deserialization vulnerabilities occur when Python applications process untrusted data through dangerous sink functions like `pickle.loads` or `yaml.load` without adequate input validation. This allows attackers to execute arbitrary code by manipulating serialized payloads.

Does unsafe yaml.load lead to arbitrary code execution in Python?▼

Unsafe `yaml.load` can lead to arbitrary code execution in Python if used to deserialize untrusted data. It acts as a dangerous sink function; without safe loading practices or input sanitization, attackers can craft malicious YAML payloads to trigger CWE-502 vulnerabilities.

Can I audit a Python web API for pickle and torch.load deserialization risks?▼

You can audit Python web APIs for `pickle` and `torch.load` deserialization risks by checking API endpoints that accept serialized data. This Skill identifies untrusted data sources flowing into dangerous sink functions and flags missing security measures.

What are the limitations of scanning for deserialization vulnerabilities?▼

Scanning for deserialization vulnerabilities focuses on identifying untrusted data sources, dangerous sink functions, and missing sanitization. Limitations include accurately tracing complex data flows across libraries like ZeroMQ and correctly validating the implementation of safe loading mechanisms.

Related Skills

Explore More Software Engineering Skills→
2389-research2389-research
90

fresh-eyes-review

Review changed files for security vulnerabilities, logic errors, and business-rule bugs before commits.

Official
Basic
DonTiziDonTizi
2

security-audit

Scan codebases for secrets, OWASP risks, and vulnerable dependencies.

Community
Advanced
SuperlendSuperlend

sarif-parsing

Parse SARIF 2.1.0 files and extract structured findings for reporting.

Official
Intermediate
AcczdyAcczdy
2

implementing-runtime-application-self-protection

Deploy RASP agents to detect and block in-app attacks in Java and Python web applications.

Community
Advanced