스킬 python-web-app-security-audit

📦

python-web-app-security-audit

Name: python-web-app-security-audit
Author: glenskii

v1.1.0 콘텐츠 리비전 r2 안전 🌐 네트워크 접근🔑 환경 변수📁 파일 시스템 접근⚙️ 외부 명령어

Audit Python Web Apps Before Release

Python teams need repeatable checks for common application security controls. This skill provides configurable pytest coverage with clear evidence, boundaries, and release decisions.

지원: Claude Codex Code(CC)

💎 90 추천

Maintain this Skill? Claim it 💎 90 추천

내 에이전트로 설치

이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.

에이전트 요청

Review the Skillstore skill "python-web-app-security-audit" from https://skillstore.io/skills/glenskii-python-web-app-security-audit.md and its manifest at https://skillstore.io/api/skills/glenskii-python-web-app-security-audit/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.

에이전트가 읽기 쉬운 리소스

AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.

Markdown 상세 GET /skills/glenskii-python-web-app-security-audit.md 서명된 manifest GET /api/skills/glenskii-python-web-app-security-audit/manifest 서명된 lockfile GET /api/skills/glenskii-python-web-app-security-audit/lockfile

테스트해 보기

"python-web-app-security-audit" 사용 중입니다. Assess authentication controls for the configured protected and admin routes.

예상 결과:

PASS: Protected and admin routes reject unauthenticated requests.
REVIEW REQUIRED: Account enumeration timing remains inconclusive under the in-process test conditions.
Boundary: External identity providers and production session infrastructure were not tested.

"python-web-app-security-audit" 사용 중입니다. Summarize a failed CORS and cookie audit.

예상 결과:

BLOCKED: The protected route accepts the hostile origin, and the session cookie lacks Secure. Restrict allowed origins, enable Secure, and rerun both checks.

"python-web-app-security-audit" 사용 중입니다. Create a release summary after all configured checks pass.

예상 결과:

PASS: Configured application-layer checks completed without blocking or review-level findings. Deployment TLS, proxy behavior, dependencies, and external services remain outside scope.

보안 감사

안전

v2 • 2026. 8. 10. 버전별 보고서 열기

All 136 static findings are false positives caused by defensive test payloads, explicit local configuration, safe copy operations, or Markdown formatting. Requests use in-process ASGITransport, active probes require owner opt-in, and no credential exfiltration, prompt injection, or malicious intent was found.

스캔된 파일

2,063

분석된 줄 수

검토 항목

오탐 무시됨

위험 요인

🌐 네트워크 접근 (16)

references/assertion-catalog.md:7 security/.env.test.template:33 security/.env.test.template:41 security/.env.test.template:42 security/conftest.py:63 security/conftest.py:80 security/conftest.py:110 security/test_config.py:149 security/test_config.py:161 security/test_cookies.py:94 security/test_cors.py:42 security/test_cors.py:56 security/test_cors.py:16 security/test_cors.py:17 security/test_headers.py:93 security/test_rate_limit.py:117

🔑 환경 변수 (50)

references/setup-and-boundaries.md:19 requirements.txt:4 security/conftest.py:18 security/conftest.py:44 security/conftest.py:76 security/conftest.py:84 security/conftest.py:85 security/conftest.py:106 security/conftest.py:113 security/conftest.py:114 security/conftest.py:131 security/conftest.py:18 security/conftest.py:44 security/conftest.py:76 security/conftest.py:84 security/conftest.py:85 security/conftest.py:106 security/conftest.py:113 security/conftest.py:114 security/conftest.py:131 security/conftest.py:10 security/conftest.py:13 security/conftest.py:10 security/conftest.py:13 security/test_auth.py:114 security/test_auth.py:149 security/test_auth.py:168 security/test_auth.py:114 security/test_auth.py:149 security/test_auth.py:168 security/test_authorization.py:15 security/test_authorization.py:24 security/test_authorization.py:64 security/test_authorization.py:15 security/test_authorization.py:24 security/test_authorization.py:64 security/test_config.py:89 security/test_config.py:90 security/test_config.py:128 security/test_config.py:88 security/test_config.py:91 security/test_config.py:97 security/test_cookies.py:37 security/test_cookies.py:38 security/test_cookies.py:60 security/test_cookies.py:61 security/test_cookies.py:81 security/test_cookies.py:82 security/test_cookies.py:106 security/test_cookies.py:107

📁 파일 시스템 접근 (3)

scripts/prepare_security_suite.py:44 scripts/prepare_security_suite.py:16 scripts/prepare_security_suite.py:40

⚙️ 외부 명령어 (17)

SKILL.md:23-25 SKILL.md:25-29 SKILL.md:29-31 SKILL.md:31-33 SKILL.md:33 SKILL.md:35 SKILL.md:39-41 SKILL.md:41-65 SKILL.md:65-66 SKILL.md:66-67 SKILL.md:67-68 SKILL.md:68-69 SKILL.md:69-70 SKILL.md:70-71 SKILL.md:71-72 SKILL.md:72-73 SKILL.md:73-74

가장 최근에 완료된 정적·의미론적 감사에서 확인된 보안 발견 사항이 감지되지 않았습니다. 이는 스킬에 부작용이 없음을 증명하지 않습니다.

감사자: codex 감사 이력 보기 →

이 보고서 공유 및 인용

버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.

버전별 보고서 열기

보고서 링크 복사

https://skillstore.io/skills/glenskii-python-web-app-security-audit/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 배지

[![Skillstore security assessment](https://skillstore.io/badges/skills/glenskii-python-web-app-security-audit/security.svg)](https://skillstore.io/skills/glenskii-python-web-app-security-audit?utm_source=security_passport_badge)

HTML 배지

<a href="https://skillstore.io/skills/glenskii-python-web-app-security-audit?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/glenskii-python-web-app-security-audit/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

임베드 카드

<iframe src="https://skillstore.io/embed/skills/glenskii-python-web-app-security-audit.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

학술 인용 (APA · BibTeX · CFF)

APA 인용

glenskii. (2026). python-web-app-security-audit security audit report (audit version 2) [Author version 1.1.0]. Skillstore. https://skillstore.io/skills/glenskii-python-web-app-security-audit/audits/2

BibTeX 인용

@techreport{glenskii-glenskii-python-web-app-security-audit-2026,
  author = {glenskii},
  title = {python-web-app-security-audit security audit report (audit version 2)},
  institution = {Skillstore},
  year = {2026},
  number = {2},
  url = {https://skillstore.io/skills/glenskii-python-web-app-security-audit/audits/2},
  note = {Author version 1.1.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "python-web-app-security-audit security audit report (audit version 2)"
version: "1.1.0"
type: report
authors:
  - name: "glenskii"
date-released: "2026-08-10"
url: "https://skillstore.io/skills/glenskii-python-web-app-security-audit/audits/2"
identifiers:
  - type: other
    value: "skillstore:glenskii-python-web-app-security-audit:audit:2"
    description: "Skillstore immutable audit report identifier"

Skillstore 점수

이 점수의 이유 증거 신뢰도: 중간

아키텍처

100

유지보수성

콘텐츠

커뮤니티

사양 준수

만들 수 있는 것

Pre-release application review

Run repeatable security checks before approving a Python service release.

Framework security regression testing

Add focused ASGI security tests to a FastAPI, Django, or adapted Flask project.

Evidence-based release gating

Record tested controls, failures, skipped checks, boundaries, and a clear release decision.

이 프롬프트를 사용해 보세요

Review the audit scope

Review this Python web application and identify which bundled security checks apply. List required routes, accounts, origins, and test boundaries.

Prepare an ASGI audit

Prepare the security suite for this application. Configure the import path and non-destructive checks, but keep active probes disabled.

Analyze test failures

Run the configured security tests and analyze each failure. Separate confirmed weaknesses, configuration mistakes, unsupported controls, and skipped checks.

Build a release decision

Perform an authorized audit with approved active probes. Produce evidence, severity, remediation, retest status, scope boundaries, and a justified release decision.

모범 사례

Use dedicated accounts, records, and an isolated non-production environment.
Configure actual routes, origins, ownership identifiers, and rate limits before interpreting results.
Record every skipped check and preserve sanitized evidence for each failure and retest.

피하기

Do not use production credentials or production data in the test configuration.
Do not enable active probes without application-owner authorization and an isolated target.
Do not treat a passing run or skipped check as proof of complete production security.

자주 묻는 질문

Which Python frameworks are supported?

FastAPI and Django ASGI applications are supported directly. Flask requires a maintained ASGI adapter.

Does the suite open a public test server?

No. It loads the configured ASGI application and sends requests through httpx ASGITransport in process.

Are active probes enabled by default?

No. Repeated, malformed, and target-specific probes remain skipped until the owner explicitly enables them.

Can this replace a penetration test?

No. It covers configured application behavior and does not establish infrastructure, dependency, or production security.

What credentials should I provide?

Use dedicated non-production user and administrator accounts. Keep the populated test environment file out of version control.

What does a passing result mean?

It means configured checks found no blocking or review-level issue. Untested controls and documented boundaries still require separate review.

개발자 세부 정보

작성자

glenskii

라이선스

MIT

작성자 버전

v1.1.0

Skillstore 리비전

리포지토리

https://github.com/glenskii/glenski-plugins/tree/0caaee95108f77a02c238ca097c14f46c95841a7/plugins/glenski-quality-suite/skills/python-web-app-security-audit

참조

8dc0b056b6c0413e53dd66fbd5e2fa5555cce8e0

유지보수 최신성

2026. 8. 11.

사용량

5 다운로드 · 4 조회

파일 구조

📁 agents/

📄 openai.yaml

📁 assets/

📄 security-audit-report-template.md

📁 docs/

📄 continuous-integration-guide.md

📄 release-decision-guide.md

📄 LICENSE

📄 pytest.ini

📄 README.md

📁 references/

📄 assertion-catalog.md

📄 fixture-safety.md

📄 framework-adapters.md

📄 route-configuration.md

📄 setup-and-boundaries.md

📄 requirements.txt

📁 scripts/

📄 prepare_security_suite.py

📁 security/

📄 .env.test.template

📄 conftest.py

📄 test_auth.py

📄 test_authorization.py

📄 test_config.py

📄 test_cookies.py

📄 test_cors.py

📄 test_errors.py

📄 test_headers.py

📄 test_rate_limit.py

📄 test_validation.py

📄 SKILL.md

glenskii의 다른 스킬

전체 보기

📦

universal-audit

Audit Software Releases with Evidence

Release decisions often rely on incomplete evidence and inconsistent standards. This skill applies structured controls, deterministic scoring, and mandatory gates to assess readiness.

보안 및 컴플라이언스 보기

📦

human-writer

Polish Drafts While Preserving Your Voice

Automated drafts can sound repetitive or overly polished and may lose the writer's original voice. This skill applies minimal editorial fixes while preserving meaning.

글쓰기 및 콘텐츠 보기

📦

task-state-ledger

Track Long Tasks With a Portable State Ledger

Long technical tasks lose decisions, evidence, and next actions across sessions. This skill maintains a concise Markdown state file with reviewed local evidence references.

생산성 보기

📦

inbox-guardian-for-gmail

Audit and Quarantine Gmail Spam Safely

Spam review can expose private mail or remove legitimate messages. This skill audits Gmail headers locally and applies only owner-confirmed quarantine or Trash actions.

보안 및 컴플라이언스 보기

전체 보기

📦