Python Security Scan Skill

This skill enables comprehensive security scanning of Python projects based on OWASP guidelines, Python security best practices, and framework-specific vulnerabilities.

When to Use This Skill

• Security audits of Python applications
• Code review for security vulnerabilities
• Pre-deployment security checks
• Dependency vulnerability assessment
• Detecting hardcoded secrets and credentials
• Framework-specific security reviews (Flask, Django, FastAPI)

Supported Frameworks

This skill automatically detects and applies framework-specific checks for:

• Flask – Template injection, session security, CORS, extensions
• Django – ORM injection, CSRF, template security, settings
• FastAPI – Dependency injection, Pydantic validation, OAuth2
• General Python – Core language vulnerabilities applicable to all projects

Scan Types

1. Quick Scan

Fast scan focusing on critical vulnerabilities:

• Hardcoded secrets, API keys, and credentials
• Dangerous function usage (eval, exec, pickle.loads)
• Command injection via subprocess, os.system
• SQL injection patterns
• Known vulnerable dependencies

2. Full Scan

Comprehensive security assessment covering:

• All OWASP Top 10:2025 categories
• Python-specific vulnerabilities
• Framework-specific security issues
• Injection vulnerabilities (SQL, NoSQL, Command, LDAP)
• Insecure deserialization
• Authentication and authorization flaws
• Cryptographic failures
• Security misconfigurations
• Dependency audit (CVE check)
• Environment variable and secrets exposure

3. Targeted Scan

Focus on specific vulnerability categories:

• --injection – SQL/NoSQL/Command/LDAP injection
• --deserialization – Pickle, YAML, JSON deserialization
• --auth – Authentication/authorization issues
• --secrets – Hardcoded credentials
• --deps – Dependency vulnerabilities
• --crypto – Cryptographic issues
• --flask – Flask-specific vulnerabilities
• --django – Django-specific vulnerabilities
• --fastapi – FastAPI-specific vulnerabilities

Scan Procedure

Step 1: Project Discovery

1. Identify project type and framework:
   • Check for requirements.txt, Pipfile, pyproject.toml, setup.py
   • Detect Flask (from flask import), Django (django.conf), FastAPI (from fastapi import)
2. Locate configuration files
3. Map the codebase structure

Step 2: Framework Detection

# Detection patterns
Flask: "from flask import", "Flask(__name__)"
Django: "django.conf.settings", "INSTALLED_APPS", "manage.py"
FastAPI: "from fastapi import", "FastAPI()"

Step 3: Dependency Audit

Run the dependency audit script:

./scripts/dependency-audit.sh /path/to/project

Or manually:

pip-audit
# or
safety check

Step 4: Secret Scanning

Scan for hardcoded secrets:

python scripts/secret-scanner.py /path/to/project

Important: Environment File Handling

• By default, real .env files are SKIPPED (.env, .env.local, .env.production, etc.)
• These files contain actual secrets and should not be in version control
• Only .env.example and .env.template files are analyzed for documentation quality
• Use --include-env-files flag only if explicitly requested by user

The scanner will:

1. Scan source code for hardcoded secrets
2. Analyze .env.example templates to check:
   • Which sensitive variables are documented
   • Whether variables have descriptions (comments)
   • If placeholder values look like real secrets
   • Suggestions for missing common variables (SECRET_KEY, DATABASE_URL, etc.)

Step 5: Pattern Analysis

For each file in the codebase, check against patterns in:

• references/python-vulnerabilities.md – Core Python issues
• references/injection-patterns.md – Injection flaws
• references/deserialization.md – Insecure deserialization
• references/flask-security.md – Flask vulnerabilities
• references/django-security.md – Django vulnerabilities
• references/fastapi-security.md – FastAPI vulnerabilities

Step 6: Report Generation

Generate a security report using:

• assets/report-template.md – Report structure

Severity Classification

Key Files to Scan

Always Check

• **/*.py – All Python source files
• requirements.txt, Pipfile, pyproject.toml – Dependencies
• setup.py, setup.cfg – Package configuration
• config.py, settings.py – Configuration files
• **/secrets*, **/credentials* – Obvious secret locations

Environment Files

• .env.example, .env.template – SCAN for template analysis
• .env, .env.local, .env.production – SKIP by default (contain real secrets)

Note: Real .env files should never be committed to version control. The scanner analyzes .env.example templates to ensure proper documentation of required variables.

High Priority Locations

• app.py, main.py, wsgi.py – Entry points
• **/views.py, **/routes.py – Request handlers
• **/api/**/*.py – API endpoints
• **/auth*, **/login* – Authentication code
• **/models.py – Database models
• **/serializers.py – Data serialization
• **/middleware.py – Middleware code

Framework-Specific

Flask:

• app.py, __init__.py – Application factory
• **/blueprints/** – Blueprint routes
• templates/** – Jinja2 templates

Django:

• settings.py, **/settings/*.py – Django settings
• urls.py – URL configuration
• **/views.py – View functions/classes
• **/forms.py – Form definitions
• templates/** – Django templates

FastAPI:

• main.py – Application entry
• **/routers/** – API routers
• **/dependencies.py – Dependency injection
• **/schemas.py – Pydantic models

Output Format

Findings should be reported as:

[SEVERITY] Category: Description
  File: path/to/file.py:lineNumber
  Code: <relevant code snippet>
  Risk: <explanation of the security risk>
  Fix: <recommended remediation>

Integration with CI/CD

This skill can generate output compatible with:

• GitHub Security Advisories
• SARIF format for GitHub Code Scanning
• JSON for custom integrations
• JUnit XML for CI pipelines

References

Load additional context as needed:

• references/owasp-top-10.md – OWASP Top 10:2025 quick reference
• references/python-vulnerabilities.md – Python-specific vulnerabilities
• references/injection-patterns.md – Injection vulnerability patterns
• references/deserialization.md – Insecure deserialization patterns
• references/flask-security.md – Flask security guide
• references/django-security.md – Django security guide
• references/fastapi-security.md – FastAPI security guide