How do I install the Auditing Python Security skill?

Run npx skillmds@latest add tomevault-io/auditing-python-security in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Auditing Python Security safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Auditing Python Security?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Auditing Python Security free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Auditing Python Security?

tomevault-io (@tomevault-io) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Auditing Python Security by tomevault-io

Name: Auditing Python Security
Author: tomevault-io

Auditing Python Security

Audits Python libraries for security vulnerabilities using Bandit, pip-audit, Semgrep, and detect-secrets. Identifies SQL injection, command injection, hardcoded credentials, weak cryptography, and insecure deserialization. Use when reviewing library security, setting up security scanning in CI, or implementing secure coding patterns. Use when this capability is needed.

tomevault-io d4c90f6 2 files · 4.4 KB Updated Sep 17, 2026

File contents

Python Security Auditing

Quick Start

# Static analysis
bandit -r src/ -ll                    # High severity only
pip-audit                             # Dependency vulnerabilities
detect-secrets scan > .secrets.baseline  # Secrets detection

Tool Configuration

Bandit (.bandit):

exclude_dirs: [tests/, docs/, .venv/]
skips: [B101]  # assert_used - OK in tests

pip-audit:

pip-audit -r requirements.txt         # Scan requirements
pip-audit --fix                       # Auto-fix vulnerabilities

Common Vulnerabilities

Issue	Bandit ID	Fix
SQL injection	B608	Use parameterized queries
Command injection	B602	subprocess without shell=True
Hardcoded secrets	B105, B106	Environment variables
Weak crypto	B303	Use SHA-256+, bcrypt for passwords
Pickle untrusted data	B301	Use JSON instead
Path traversal	B108	Validate with Path.resolve()

Secure Patterns

# SQL - Parameterized query
conn.execute("SELECT * FROM users WHERE id = ?", (user_id,))

# Commands - No shell
subprocess.run(["cat", filename], check=True)

# Secrets - Environment
API_KEY = os.environ.get("API_KEY")

# Paths - Validate
base = Path("/data").resolve()
file_path = (base / filename).resolve()
if not file_path.is_relative_to(base):
    raise ValueError("Invalid path")

CI Integration

# .github/workflows/security.yml
- run: bandit -r src/ -ll
- run: pip-audit
- run: detect-secrets scan --all-files

For detailed patterns, see:

VULNERABILITIES.md - Full vulnerability examples
CI_SECURITY.md - Complete CI workflow

Audit Checklist

Code:
- [ ] No SQL injection (parameterized queries)
- [ ] No command injection (no shell=True)
- [ ] No hardcoded secrets
- [ ] No weak crypto (MD5/SHA1)
- [ ] Input validation on external data
- [ ] Path traversal prevention

Dependencies:
- [ ] pip-audit clean
- [ ] Minimal dependencies
- [ ] From trusted sources

CI:
- [ ] Security scan on every PR
- [ ] Weekly dependency scan

Learn More

This skill is based on the Security section of the Guide to Developing High-Quality Python Libraries by Will McGinnis. See these posts for deeper coverage:

Converted and distributed by TomeVault — claim your Tome and manage your conversions.

---name: auditing-python-securitydescription: Audits Python libraries for security vulnerabilities using Bandit, pip-audit, Semgrep, and detect-secrets. Identifies SQL injection, command injection, hardcoded credentials, weak cryptography, and insecure deserialization. Use when reviewing library security, setting up security scanning in CI, or implementing secure coding patterns. Use when this capability is needed.---# Python Security Auditing## Quick Start```bash# Static analysisbandit -r src/ -ll # High severity onlypip-audit # Dependency vulnerabilitiesdetect-secrets scan > .secrets.baseline # Secrets detection```## Tool Configuration**Bandit (.bandit):**```yamlexclude_dirs: [tests/, docs/, .venv/]skips: [B101] # assert_used - OK in tests```**pip-audit:**```bashpip-audit -r requirements.txt # Scan requirementspip-audit --fix # Auto-fix vulnerabilities```## Common Vulnerabilities| Issue | Bandit ID | Fix ||-------|-----------|-----|| SQL injection | B608 | Use parameterized queries || Command injection | B602 | subprocess without shell=True || Hardcoded secrets | B105, B106 | Environment variables || Weak crypto | B303 | Use SHA-256+, bcrypt for passwords || Pickle untrusted data | B301 | Use JSON instead || Path traversal | B108 | Validate with Path.resolve() |## Secure Patterns```python# SQL - Parameterized queryconn.execute("SELECT * FROM users WHERE id = ?", (user_id,))# Commands - No shellsubprocess.run(["cat", filename], check=True)# Secrets - EnvironmentAPI_KEY = os.environ.get("API_KEY")# Paths - Validatebase = Path("/data").resolve()file_path = (base / filename).resolve()if not file_path.is_relative_to(base): raise ValueError("Invalid path")```## CI Integration```yaml# .github/workflows/security.yml- run: bandit -r src/ -ll- run: pip-audit- run: detect-secrets scan --all-files```For detailed patterns, see:- **[VULNERABILITIES.md](VULNERABILITIES.md)** - Full vulnerability examples- **[CI_SECURITY.md](CI_SECURITY.md)** - Complete CI workflow## Audit Checklist```Code:- [ ] No SQL injection (parameterized queries)- [ ] No command injection (no shell=True)- [ ] No hardcoded secrets- [ ] No weak crypto (MD5/SHA1)- [ ] Input validation on external data- [ ] Path traversal preventionDependencies:- [ ] pip-audit clean- [ ] Minimal dependencies- [ ] From trusted sourcesCI:- [ ] Security scan on every PR- [ ] Weekly dependency scan```## Learn MoreThis skill is based on the [Security](https://mcginniscommawill.com/guides/python-library-development/#security-a-matter-of-trust) section of the [Guide to Developing High-Quality Python Libraries](https://mcginniscommawill.com/guides/python-library-development/) by [Will McGinnis](https://mcginniscommawill.com/). See these posts for deeper coverage:- [Avoiding Injection Flaws](https://mcginniscommawill.com/posts/2025-01-18-avoiding-injection-flaws/)- [Intro to Bandit](https://mcginniscommawill.com/posts/2025-01-25-intro-to-bandit/)- [Advanced Bandit Configuration](https://mcginniscommawill.com/posts/2025-08-22-advanced-bandit-configuration/)- [SQL Injection Detection](https://mcginniscommawill.com/posts/2025-08-25-sql-injection-detection-b608/)- [Dependency Security with pip-audit](https://mcginniscommawill.com/posts/2025-01-27-dependency-security-pip-audit/)- [Handling Sensitive Data](https://mcginniscommawill.com/posts/2025-01-29-handling-sensitive-data/)- [Secure Coding Practices](https://mcginniscommawill.com/posts/2025-02-02-secure-coding-practices/)---> Converted and distributed by [TomeVault](https://tomevault.io/claim/wdm0006) — claim your Tome and manage your conversions.

Frequently asked questions