python-web-app-security-audit
Audit Python Web Apps Before Release
Python teams need repeatable checks for common application security controls. This skill provides configurable pytest coverage with clear evidence, boundaries, and release decisions.
Instalar com meu Agente
Copie esta solicitação para o seu Agente. Ela inclui a página canônica do Skill e o manifesto.
Review the Skillstore skill "python-web-app-security-audit" from https://skillstore.io/skills/glenskii-python-web-app-security-audit.md and its manifest at https://skillstore.io/api/skills/glenskii-python-web-app-security-audit/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Seu Agente ainda deve apresentar o plano e solicitar qualquer confirmação exigida pela política de segurança.
Recursos legíveis por agentes
Use estes links quando um agente de IA, crawler ou script precisar de contexto limpo em vez de ler a página completa.
Testar
Usando "python-web-app-security-audit". Assess authentication controls for the configured protected and admin routes.
Resultado esperado:
- PASS: Protected and admin routes reject unauthenticated requests.
- REVIEW REQUIRED: Account enumeration timing remains inconclusive under the in-process test conditions.
- Boundary: External identity providers and production session infrastructure were not tested.
Usando "python-web-app-security-audit". Summarize a failed CORS and cookie audit.
Resultado esperado:
BLOCKED: The protected route accepts the hostile origin, and the session cookie lacks Secure. Restrict allowed origins, enable Secure, and rerun both checks.
Usando "python-web-app-security-audit". Create a release summary after all configured checks pass.
Resultado esperado:
PASS: Configured application-layer checks completed without blocking or review-level findings. Deployment TLS, proxy behavior, dependencies, and external services remain outside scope.
Auditoria de segurança
SeguroAll 136 static findings are false positives caused by defensive test payloads, explicit local configuration, safe copy operations, or Markdown formatting. Requests use in-process ASGITransport, active probes require owner opt-in, and no credential exfiltration, prompt injection, or malicious intent was found.
Fatores de risco
🌐 Acesso à rede (16)
🔑 Variáveis de ambiente (50)
📁 Acesso ao sistema de arquivos (3)
Compartilhar e citar este relatório
Compartilhe o relatório de avaliação versionado, o badge neutro, o cartão incorporável e as citações. A Skillstore apresenta evidências sem decidir se este Skill é seguro.
Copiar link do relatório
https://skillstore.io/skills/glenskii-python-web-app-security-audit/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportBadge Markdown
[](https://skillstore.io/skills/glenskii-python-web-app-security-audit?utm_source=security_passport_badge)Badge HTML
<a href="https://skillstore.io/skills/glenskii-python-web-app-security-audit?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/glenskii-python-web-app-security-audit/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Cartão incorporável
<iframe src="https://skillstore.io/embed/skills/glenskii-python-web-app-security-audit.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Citações acadêmicas (APA · BibTeX · CFF)
Citação APA
glenskii. (2026). python-web-app-security-audit security audit report (audit version 2) [Author version 1.1.0]. Skillstore. https://skillstore.io/skills/glenskii-python-web-app-security-audit/audits/2Citação BibTeX
@techreport{glenskii-glenskii-python-web-app-security-audit-2026,
author = {glenskii},
title = {python-web-app-security-audit security audit report (audit version 2)},
institution = {Skillstore},
year = {2026},
number = {2},
url = {https://skillstore.io/skills/glenskii-python-web-app-security-audit/audits/2},
note = {Author version 1.1.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "python-web-app-security-audit security audit report (audit version 2)"
version: "1.1.0"
type: report
authors:
- name: "glenskii"
date-released: "2026-08-10"
url: "https://skillstore.io/skills/glenskii-python-web-app-security-audit/audits/2"
identifiers:
- type: other
value: "skillstore:glenskii-python-web-app-security-audit:audit:2"
description: "Skillstore immutable audit report identifier"
Pontuação do Skillstore
Por que esta pontuação Confiança das evidências: MédioO que você pode criar
Pre-release application review
Run repeatable security checks before approving a Python service release.
Framework security regression testing
Add focused ASGI security tests to a FastAPI, Django, or adapted Flask project.
Evidence-based release gating
Record tested controls, failures, skipped checks, boundaries, and a clear release decision.
Teste estes prompts
Review this Python web application and identify which bundled security checks apply. List required routes, accounts, origins, and test boundaries.
Prepare the security suite for this application. Configure the import path and non-destructive checks, but keep active probes disabled.
Run the configured security tests and analyze each failure. Separate confirmed weaknesses, configuration mistakes, unsupported controls, and skipped checks.
Perform an authorized audit with approved active probes. Produce evidence, severity, remediation, retest status, scope boundaries, and a justified release decision.
Boas práticas
- Use dedicated accounts, records, and an isolated non-production environment.
- Configure actual routes, origins, ownership identifiers, and rate limits before interpreting results.
- Record every skipped check and preserve sanitized evidence for each failure and retest.
Evitar
- Do not use production credentials or production data in the test configuration.
- Do not enable active probes without application-owner authorization and an isolated target.
- Do not treat a passing run or skipped check as proof of complete production security.
Perguntas frequentes
Which Python frameworks are supported?
Does the suite open a public test server?
Are active probes enabled by default?
Can this replace a penetration test?
What credentials should I provide?
What does a passing result mean?
Detalhes do desenvolvedor
Autor
glenskiiLicença
MIT
Versão do autor
v1.1.0
Revisão da Skillstore
r2
Referência
8dc0b056b6c0413e53dd66fbd5e2fa5555cce8e0
Atualidade da manutenção
11/08/2026
Uso
5 downloads · 4 visualizações
Estrutura de arquivos