Habilidades python-web-app-security-audit

📦

python-web-app-security-audit

Name: python-web-app-security-audit
Author: glenskii

v1.1.0 Revisión del contenido r2 Seguro 🌐 Acceso a red🔑 Variables de entorno📁 Acceso al sistema de archivos⚙️ Comandos externos

Audit Python Web Apps Before Release

Python teams need repeatable checks for common application security controls. This skill provides configurable pytest coverage with clear evidence, boundaries, and release decisions.

Compatible con: Claude Codex Code(CC)

💎 90 Destacado

Instalar con mi Agente

Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.

Solicitud de agente

Review the Skillstore skill "python-web-app-security-audit" from https://skillstore.io/skills/glenskii-python-web-app-security-audit.md and its manifest at https://skillstore.io/api/skills/glenskii-python-web-app-security-audit/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.

Recursos legibles por agentes

Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.

Detalle Markdown GET /skills/glenskii-python-web-app-security-audit.md Manifest firmado GET /api/skills/glenskii-python-web-app-security-audit/manifest Lockfile firmado GET /api/skills/glenskii-python-web-app-security-audit/lockfile

Pruébalo

Usando "python-web-app-security-audit". Assess authentication controls for the configured protected and admin routes.

Resultado esperado:

PASS: Protected and admin routes reject unauthenticated requests.
REVIEW REQUIRED: Account enumeration timing remains inconclusive under the in-process test conditions.
Boundary: External identity providers and production session infrastructure were not tested.

Usando "python-web-app-security-audit". Summarize a failed CORS and cookie audit.

Resultado esperado:

BLOCKED: The protected route accepts the hostile origin, and the session cookie lacks Secure. Restrict allowed origins, enable Secure, and rerun both checks.

Usando "python-web-app-security-audit". Create a release summary after all configured checks pass.

Resultado esperado:

PASS: Configured application-layer checks completed without blocking or review-level findings. Deployment TLS, proxy behavior, dependencies, and external services remain outside scope.

Auditoría de seguridad

Seguro

v2 • 10/8/2026 Abrir el informe versionado

All 136 static findings are false positives caused by defensive test payloads, explicit local configuration, safe copy operations, or Markdown formatting. Requests use in-process ASGITransport, active probes require owner opt-in, and no credential exfiltration, prompt injection, or malicious intent was found.

Archivos escaneados

2,063

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Factores de riesgo

🌐 Acceso a red (16)

references/assertion-catalog.md:7 security/.env.test.template:33 security/.env.test.template:41 security/.env.test.template:42 security/conftest.py:63 security/conftest.py:80 security/conftest.py:110 security/test_config.py:149 security/test_config.py:161 security/test_cookies.py:94 security/test_cors.py:42 security/test_cors.py:56 security/test_cors.py:16 security/test_cors.py:17 security/test_headers.py:93 security/test_rate_limit.py:117

🔑 Variables de entorno (50)

references/setup-and-boundaries.md:19 requirements.txt:4 security/conftest.py:18 security/conftest.py:44 security/conftest.py:76 security/conftest.py:84 security/conftest.py:85 security/conftest.py:106 security/conftest.py:113 security/conftest.py:114 security/conftest.py:131 security/conftest.py:18 security/conftest.py:44 security/conftest.py:76 security/conftest.py:84 security/conftest.py:85 security/conftest.py:106 security/conftest.py:113 security/conftest.py:114 security/conftest.py:131 security/conftest.py:10 security/conftest.py:13 security/conftest.py:10 security/conftest.py:13 security/test_auth.py:114 security/test_auth.py:149 security/test_auth.py:168 security/test_auth.py:114 security/test_auth.py:149 security/test_auth.py:168 security/test_authorization.py:15 security/test_authorization.py:24 security/test_authorization.py:64 security/test_authorization.py:15 security/test_authorization.py:24 security/test_authorization.py:64 security/test_config.py:89 security/test_config.py:90 security/test_config.py:128 security/test_config.py:88 security/test_config.py:91 security/test_config.py:97 security/test_cookies.py:37 security/test_cookies.py:38 security/test_cookies.py:60 security/test_cookies.py:61 security/test_cookies.py:81 security/test_cookies.py:82 security/test_cookies.py:106 security/test_cookies.py:107

📁 Acceso al sistema de archivos (3)

scripts/prepare_security_suite.py:44 scripts/prepare_security_suite.py:16 scripts/prepare_security_suite.py:40

⚙️ Comandos externos (17)

SKILL.md:23-25 SKILL.md:25-29 SKILL.md:29-31 SKILL.md:31-33 SKILL.md:33 SKILL.md:35 SKILL.md:39-41 SKILL.md:41-65 SKILL.md:65-66 SKILL.md:66-67 SKILL.md:67-68 SKILL.md:68-69 SKILL.md:69-70 SKILL.md:70-71 SKILL.md:71-72 SKILL.md:72-73 SKILL.md:73-74

La auditoría estática y semántica completada más reciente no detectó hallazgos de seguridad confirmados. Esto no demuestra que el skill no tenga efectos secundarios.

Auditado por: codex Ver historial de auditorías →

Compartir y citar este informe

Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.

Abrir el informe versionado

Copiar enlace del informe

https://skillstore.io/skills/glenskii-python-web-app-security-audit/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Insignia Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/glenskii-python-web-app-security-audit/security.svg)](https://skillstore.io/skills/glenskii-python-web-app-security-audit?utm_source=security_passport_badge)

Insignia HTML

<a href="https://skillstore.io/skills/glenskii-python-web-app-security-audit?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/glenskii-python-web-app-security-audit/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Tarjeta para insertar

<iframe src="https://skillstore.io/embed/skills/glenskii-python-web-app-security-audit.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citas académicas (APA · BibTeX · CFF)

Cita APA

glenskii. (2026). python-web-app-security-audit security audit report (audit version 2) [Author version 1.1.0]. Skillstore. https://skillstore.io/skills/glenskii-python-web-app-security-audit/audits/2

Cita BibTeX

@techreport{glenskii-glenskii-python-web-app-security-audit-2026,
  author = {glenskii},
  title = {python-web-app-security-audit security audit report (audit version 2)},
  institution = {Skillstore},
  year = {2026},
  number = {2},
  url = {https://skillstore.io/skills/glenskii-python-web-app-security-audit/audits/2},
  note = {Author version 1.1.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "python-web-app-security-audit security audit report (audit version 2)"
version: "1.1.0"
type: report
authors:
  - name: "glenskii"
date-released: "2026-08-10"
url: "https://skillstore.io/skills/glenskii-python-web-app-security-audit/audits/2"
identifiers:
  - type: other
    value: "skillstore:glenskii-python-web-app-security-audit:audit:2"
    description: "Skillstore immutable audit report identifier"

Puntuación de Skillstore

Por qué esta puntuación Confianza de la evidencia: Medio

Arquitectura

100

Mantenibilidad

Contenido

Comunidad

Cumplimiento de la especificación

Lo que puedes crear

Pre-release application review

Run repeatable security checks before approving a Python service release.

Framework security regression testing

Add focused ASGI security tests to a FastAPI, Django, or adapted Flask project.

Evidence-based release gating

Record tested controls, failures, skipped checks, boundaries, and a clear release decision.

Prueba estos prompts

Review the audit scope

Review this Python web application and identify which bundled security checks apply. List required routes, accounts, origins, and test boundaries.

Prepare an ASGI audit

Prepare the security suite for this application. Configure the import path and non-destructive checks, but keep active probes disabled.

Analyze test failures

Run the configured security tests and analyze each failure. Separate confirmed weaknesses, configuration mistakes, unsupported controls, and skipped checks.

Build a release decision

Perform an authorized audit with approved active probes. Produce evidence, severity, remediation, retest status, scope boundaries, and a justified release decision.

Mejores prácticas

Use dedicated accounts, records, and an isolated non-production environment.
Configure actual routes, origins, ownership identifiers, and rate limits before interpreting results.
Record every skipped check and preserve sanitized evidence for each failure and retest.

Evitar

Do not use production credentials or production data in the test configuration.
Do not enable active probes without application-owner authorization and an isolated target.
Do not treat a passing run or skipped check as proof of complete production security.