cpython agents

ReviewToolkits/cpython-security-toolkit

Agent

Detects file-loading paths that bypass sys.audit() hooks by using open() instead of io.opencode(), and shell-calling paths where validation occurs before template substitution. Invoke when scanning importlib, webbrowser, or venv.

ReviewToolkits/cpython-security-toolkit

Agent

Detects decompression paths that materialize unbounded output before applying a size check, and allocations whose size is directly controlled by attacker-supplied archive metadata. Invoke when scanning zipfile, tarfile, lzma, bz2, gzip, or plistlib.

ReviewToolkits/cpython-security-toolkit

Agent

Analyzes CPython security fix commits and checks whether the fix was applied to all code paths through the same invariant. The most important agent for preventing second-round CVEs. Invoke after identifying a security fix commit or when reviewing recent type-security labeled changes.