Deserialization Audit
Installation
SKILL.md
phy-deserialization-audit
Static scanner for OWASP A08:2021 — Insecure Deserialization vulnerabilities across Python, Java, PHP, Ruby, Node.js/TypeScript, and Go codebases. No API keys, no network calls, no dependencies beyond Python 3 stdlib.
What It Detects
Python
| Pattern | Severity | CVE/CWE |
|---|---|---|
pickle.loads(user_data) |
CRITICAL | CWE-502 |
pickle.load(untrusted_file) |
CRITICAL | CWE-502 |
yaml.load(data) without SafeLoader |
HIGH | CVE-2017-18342 |
yaml.full_load() / yaml.unsafe_load() |
CRITICAL | CVE-2017-18342 |
jsonpickle.decode(input) |
CRITICAL | CWE-502 |
marshal.loads(data) |
HIGH | CWE-502 |
eval(user_input) / exec(user_input) |
CRITICAL | CWE-95 |
shelve.open(user_controlled_path) |
HIGH | CWE-502 |