技能 python-web-app-security-audit
📦
python-web-app-security-audit
v1.1.0 內容修訂 r2 安全 🌐 網路存取🔑 環境變數📁 檔案系統存取⚙️ 外部命令
Audit Python Web Apps Before Release
Python teams need repeatable checks for common application security controls. This skill provides configurable pytest coverage with clear evidence, boundaries, and release decisions.
支援: Claude Codex Code(CC)
使用我的智慧代理安裝
將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。
智能體請求
Review the Skillstore skill "python-web-app-security-audit" from https://skillstore.io/skills/glenskii-python-web-app-security-audit.md and its manifest at https://skillstore.io/api/skills/glenskii-python-web-app-security-audit/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。
Agent 可讀資源
當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。
測試它
正在使用「python-web-app-security-audit」。 Assess authentication controls for the configured protected and admin routes.
預期結果:
- PASS: Protected and admin routes reject unauthenticated requests.
- REVIEW REQUIRED: Account enumeration timing remains inconclusive under the in-process test conditions.
- Boundary: External identity providers and production session infrastructure were not tested.
正在使用「python-web-app-security-audit」。 Summarize a failed CORS and cookie audit.
預期結果:
BLOCKED: The protected route accepts the hostile origin, and the session cookie lacks Secure. Restrict allowed origins, enable Secure, and rerun both checks.
正在使用「python-web-app-security-audit」。 Create a release summary after all configured checks pass.
預期結果:
PASS: Configured application-layer checks completed without blocking or review-level findings. Deployment TLS, proxy behavior, dependencies, and external services remain outside scope.
安全審計
安全v2 • 2026/8/10 開啟版本化報告
All 136 static findings are false positives caused by defensive test payloads, explicit local configuration, safe copy operations, or Markdown formatting. Requests use in-process ASGITransport, active probes require owner opt-in, and no credential exfiltration, prompt injection, or malicious intent was found.
26
已掃描檔案
2,063
分析行數
0
複核項目
0
已忽略的誤報
風險因素
🌐 網路存取 (16)
references/assertion-catalog.md:7 security/.env.test.template:33 security/.env.test.template:41 security/.env.test.template:42 security/conftest.py:63 security/conftest.py:80 security/conftest.py:110 security/test_config.py:149 security/test_config.py:161 security/test_cookies.py:94 security/test_cors.py:42 security/test_cors.py:56 security/test_cors.py:16 security/test_cors.py:17 security/test_headers.py:93 security/test_rate_limit.py:117
🔑 環境變數 (50)
references/setup-and-boundaries.md:19 requirements.txt:4 security/conftest.py:18 security/conftest.py:44 security/conftest.py:76 security/conftest.py:84 security/conftest.py:85 security/conftest.py:106 security/conftest.py:113 security/conftest.py:114 security/conftest.py:131 security/conftest.py:18 security/conftest.py:44 security/conftest.py:76 security/conftest.py:84 security/conftest.py:85 security/conftest.py:106 security/conftest.py:113 security/conftest.py:114 security/conftest.py:131 security/conftest.py:10 security/conftest.py:13 security/conftest.py:10 security/conftest.py:13 security/test_auth.py:114 security/test_auth.py:149 security/test_auth.py:168 security/test_auth.py:114 security/test_auth.py:149 security/test_auth.py:168 security/test_authorization.py:15 security/test_authorization.py:24 security/test_authorization.py:64 security/test_authorization.py:15 security/test_authorization.py:24 security/test_authorization.py:64 security/test_config.py:89 security/test_config.py:90 security/test_config.py:128 security/test_config.py:88 security/test_config.py:91 security/test_config.py:97 security/test_cookies.py:37 security/test_cookies.py:38 security/test_cookies.py:60 security/test_cookies.py:61 security/test_cookies.py:81 security/test_cookies.py:82 security/test_cookies.py:106 security/test_cookies.py:107
📁 檔案系統存取 (3)
最近一次完成的靜態與語意稽核未偵測到已確認的安全發現。這並不能證明該 Skill 沒有副作用。
審計單位: codex 檢視審計紀錄 →
分享與引用此報告
分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。
複製報告連結
https://skillstore.io/skills/glenskii-python-web-app-security-audit/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/glenskii-python-web-app-security-audit?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/glenskii-python-web-app-security-audit?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/glenskii-python-web-app-security-audit/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/glenskii-python-web-app-security-audit.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>學術引用 (APA · BibTeX · CFF)
APA 引用
glenskii. (2026). python-web-app-security-audit security audit report (audit version 2) [Author version 1.1.0]. Skillstore. https://skillstore.io/skills/glenskii-python-web-app-security-audit/audits/2BibTeX 引用
@techreport{glenskii-glenskii-python-web-app-security-audit-2026,
author = {glenskii},
title = {python-web-app-security-audit security audit report (audit version 2)},
institution = {Skillstore},
year = {2026},
number = {2},
url = {https://skillstore.io/skills/glenskii-python-web-app-security-audit/audits/2},
note = {Author version 1.1.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "python-web-app-security-audit security audit report (audit version 2)"
version: "1.1.0"
type: report
authors:
- name: "glenskii"
date-released: "2026-08-10"
url: "https://skillstore.io/skills/glenskii-python-web-app-security-audit/audits/2"
identifiers:
- type: other
value: "skillstore:glenskii-python-web-app-security-audit:audit:2"
description: "Skillstore immutable audit report identifier"
Skillstore 評分
評分依據 證據置信度: 中 95
架構
100
可維護性
87
內容
65
社群
91
規範符合度
你可以打造什麼
Pre-release application review
Run repeatable security checks before approving a Python service release.
Framework security regression testing
Add focused ASGI security tests to a FastAPI, Django, or adapted Flask project.
Evidence-based release gating
Record tested controls, failures, skipped checks, boundaries, and a clear release decision.
試試這些提示
Review the audit scope
Review this Python web application and identify which bundled security checks apply. List required routes, accounts, origins, and test boundaries.
Prepare an ASGI audit
Prepare the security suite for this application. Configure the import path and non-destructive checks, but keep active probes disabled.
Analyze test failures
Run the configured security tests and analyze each failure. Separate confirmed weaknesses, configuration mistakes, unsupported controls, and skipped checks.
Build a release decision
Perform an authorized audit with approved active probes. Produce evidence, severity, remediation, retest status, scope boundaries, and a justified release decision.
最佳實務
- Use dedicated accounts, records, and an isolated non-production environment.
- Configure actual routes, origins, ownership identifiers, and rate limits before interpreting results.
- Record every skipped check and preserve sanitized evidence for each failure and retest.
避免
- Do not use production credentials or production data in the test configuration.
- Do not enable active probes without application-owner authorization and an isolated target.
- Do not treat a passing run or skipped check as proof of complete production security.
常見問題
Which Python frameworks are supported?
FastAPI and Django ASGI applications are supported directly. Flask requires a maintained ASGI adapter.
Does the suite open a public test server?
No. It loads the configured ASGI application and sends requests through httpx ASGITransport in process.
Are active probes enabled by default?
No. Repeated, malformed, and target-specific probes remain skipped until the owner explicitly enables them.
Can this replace a penetration test?
No. It covers configured application behavior and does not establish infrastructure, dependency, or production security.
What credentials should I provide?
Use dedicated non-production user and administrator accounts. Keep the populated test environment file out of version control.
What does a passing result mean?
It means configured checks found no blocking or review-level issue. Untested controls and documented boundaries still require separate review.
開發者詳細資訊
作者
glenskii授權
MIT
作者版本
v1.1.0
Skillstore 修訂
r2
引用
8dc0b056b6c0413e53dd66fbd5e2fa5555cce8e0
維護新鮮度
2026/8/11
使用量
5 次下載 · 4 次瀏覽
檔案結構