# Audit Python Web Apps Before Release

Python teams need repeatable checks for common application security controls. This skill provides configurable pytest coverage with clear evidence, boundaries, and release decisions.

## Install

```bash
npx skillstore add glenskii/python-web-app-security-audit
```

## Metadata

- Status: approved
- Slug: glenskii-python-web-app-security-audit
- Version: 1.1.0
- Author version: 1.1.0
- Skillstore revision: r2
- Version status: valid
- Tree hash: c8c7c5be8fca7a64d91c856fde30b4223fb1c708f407b07bfc8a8f765d144643
- Author: glenskii
- GitHub username: glenskii
- License: MIT
- Repository: https://github.com/glenskii/glenski-plugins/tree/0caaee95108f77a02c238ca097c14f46c95841a7/plugins/glenski-quality-suite/skills/python-web-app-security-audit
- Ref: 8dc0b056b6c0413e53dd66fbd5e2fa5555cce8e0
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: network, env\_access, filesystem, external\_commands
- Quality score: 90
- Quality tier: featured
- Public page: https://skillstore.pages.dev/skills/glenskii-python-web-app-security-audit
- Manifest: https://skillstore.pages.dev/api/skills/glenskii-python-web-app-security-audit/manifest

## Capabilities

- Copies the bundled security suite into a selected project without overwriting an existing security directory.
- Loads an importable ASGI application and tests it in process with pytest and httpx ASGITransport.
- Checks authentication, authorization, input validation, headers, CORS, cookies, rate limits, errors, methods, and configuration.
- Skips malformed, repeated, and target-specific probes until the application owner explicitly enables them.
- Provides reporting templates and guidance for PASS, REVIEW REQUIRED, and BLOCKED release decisions.

## Use Cases

- Pre-release application review: Run repeatable security checks before approving a Python service release.
- Framework security regression testing: Add focused ASGI security tests to a FastAPI, Django, or adapted Flask project.
- Evidence-based release gating: Record tested controls, failures, skipped checks, boundaries, and a clear release decision.

## Prompt Templates

### Review the audit scope

```
Review this Python web application and identify which bundled security checks apply. List required routes, accounts, origins, and test boundaries.
```

### Prepare an ASGI audit

```
Prepare the security suite for this application. Configure the import path and non-destructive checks, but keep active probes disabled.
```

### Analyze test failures

```
Run the configured security tests and analyze each failure. Separate confirmed weaknesses, configuration mistakes, unsupported controls, and skipped checks.
```

### Build a release decision

```
Perform an authorized audit with approved active probes. Produce evidence, severity, remediation, retest status, scope boundaries, and a justified release decision.
```

## Limitations

- It does not test deployment TLS, reverse proxies, WAF controls, cloud configuration, or external infrastructure.
- It cannot prove complete security or cover routes and controls that are not configured.
- Flask applications require a maintained ASGI adapter before this suite can test them.
- Results depend on accurate routes, dedicated accounts, ownership records, origins, and rate thresholds.

## Best Practices

- Use dedicated accounts, records, and an isolated non-production environment.
- Configure actual routes, origins, ownership identifiers, and rate limits before interpreting results.
- Record every skipped check and preserve sanitized evidence for each failure and retest.

## Anti Patterns

- Do not use production credentials or production data in the test configuration.
- Do not enable active probes without application-owner authorization and an isolated target.
- Do not treat a passing run or skipped check as proof of complete production security.

## Security Audit

- Audited at: 2026-08-10T11:14:21.819\+00:00
- Summary: All 136 static findings are false positives caused by defensive test payloads, explicit local configuration, safe copy operations, or Markdown formatting. Requests use in-process ASGITransport, active probes require owner opt-in, and no credential exfiltration, prompt injection, or malicious intent was found.

## Stats

- Views: 4
- Downloads: 8
- Favorites: 1
- Popularity score: 0