Borrowing it
Nothing to install: this file belongs to Insight-Services-APAC/ingenious. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Insight-Services-APAC/ingenious/main/.claude/commands/quality/py-quality/bandit.mdgit clone --depth 1 https://github.com/Insight-Services-APAC/ingeniousWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/insight-services-apac/ingenious/bandit)<a href="https://agentmods.dev/commands/insight-services-apac/ingenious/bandit"><img src="https://agentmods.dev/badge/commands/insight-services-apac/ingenious/bandit.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.00574 |
| Opus 5 | $0.00000 | $0.00287 |
| Sonnet 5 | $0.00000 | $0.00115 |
| Haiku 4.5 | $0.00000 | $0.00057 |
Grade A, and why
bandit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 70 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Security Hardening Using Bandit
Use Bandit to detect common Python security issues and refactor code safely.
1. Run Bandit Scan
uv run bandit -q -r . -ll # -ll => only medium+ severity (adjust as needed)
# For full context
uv run bandit -r . -f screen
If repo large, target app dirs: uv run bandit -r ingenious ingenious_extensions.
2. Parse Findings
For each issue note:
- File:Line
- Test ID (e.g., B303)
- Severity / Confidence
- Short description
Create a working list sorted: High severity first, then Medium.
3. Classify Each Finding
For each finding, assign one classification:
- TRUE_POSITIVE - Fix immediately
- NEEDS_REFACTOR - Create safer abstraction then fix
- FALSE_POSITIVE - Justify and suppress locally with comment
- ACCEPT_RISK_TEMPORARILY - Open tracking issue (include rationale + mitigation plan)
4. Fix Patterns
Common Bandit IDs and actions:
- B303/B304 (insecure hash) → use hashlib.sha256 / blake2b
- B102 (exec) / B602-B607 (subprocess shell) → remove shell=True, use args list
- B301 (pickle) → replace with json / safe serializer; if unavoidable isolate & document
- B108 (hardcoded tmp) → use tempfile module
- B105 (hardcoded password) → move to secret manager / env var
- B403 (import * requests) → explicit imports
- B410 (insecure yaml.load) → use yaml.safe_load
- B501 (request w/ verify=False) → enable cert validation or document internal CA
- B608 (SQL injection) → parameterize queries via driver placeholders
5. Implement Fix Incrementally
For each finding fixed:
uv run pytest -q
uv run bandit -q -r <affected_paths>
Commit if clean:
git add <files>
git commit -m "security(bandit): mitigate <TestID> in <symbol>"
6. Suppressing False Positives
Use the narrowest suppression:
# nosec B608: parameterized via execute(params)
Document reasoning in code or SECURITY_NOTES.md.
7. Final Full Scan & Quality Gate
uv run bandit -r .
uv run pytest
uv run pre-commit run --all-files
uv run mypy . --exclude venv
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 70 lines · 0 tokens per session scan A 4f53ce8d1565
bandit is a command published in the GitHub repository Insight-Services-APAC/ingenious (24 stars, last pushed 7mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 574 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-04.
Other commands, from other repositories
remote-autopilot-install.v1
Remotely install Stakpak Autopilot on any reachable Linux host over SSH, with optional AWS/GCP/Azure VM discovery or provisioning: /remote-autopilot-install.
requirement-review
需求文档多角色评审（requirement-review）：需求文档 → 7-Agent 并行评审 → 重构高质量需求文档（Runtime 受控流程，0-7 阶段状态机）.
add-charts
Integrate Chart.js or Recharts for data visualization. Create reusable chart components: line, bar, pie, area, scatter. Implement responsive sizing with container-based dimensions. Add interactive tooltips showing detailed data on hover. Create customizable legends with click-to-hide series. Support real-time data…
add-api-railway
Create a new Express API endpoint with full integration.
checklist
Generate a custom checklist for the current feature based on user requirements.
clarify
Identify underspecified areas in the current feature spec by asking up to 5 highly targeted clarification questions and encoding answers back into the spec.