Python Security

REFERENCE MODE: This skill provides reference material for Python security review and hardening. Load specific standards on-demand based on current task. Do not load all standards at once.

Enforcement

Execution mode: Reference library; load standards on-demand for Python security review and hardening tasks.

Prohibited actions:

• Do not pass untrusted input to subprocess with shell=True; use an argv list
• Do not pickle.load/pickle.loads untrusted bytes, nor yaml.load without a safe loader
• Do not eval/exec/compile externally-sourced strings; use ast.literal_eval for literals
• Do not interpolate user values into SQL query strings; use DB-API placeholders with a params tuple

Constraints:

• Every externally-sourced value (request data, file contents, environment, CLI args) is untrusted at stdlib boundaries
• User-supplied paths must be validated against a safe base to prevent traversal
• Reject untrusted input that fails a boundary check; never coerce it through