A Claude Code plugin for finding semantic security flaws in CPython's standard library — archive extraction boundaries, validation coverage gaps, resource amplification, and audit hook bypass.
This repository also configures its own agents. See what cpython-security-toolkit tells them →
ReviewToolkits/cpython-security-toolkit
Command Claude Code
Archive extraction boundary analysis. Checks whether CPython's tarfile, zipfile, and shutil.unpackarchive implementations correctly enforce the invariant that no extraction path may write outside the declared destination directory.
ReviewToolkits/cpython-security-toolkit
Command Claude Code
Audit hook coverage analysis. Checks whether CPython's file-loading and shell-calling paths correctly emit sys.audit() events and whether security controls depending on those events can be bypassed via alternative code paths.
ReviewToolkits/cpython-security-toolkit
Command Claude Code
Protocol validation coverage analysis. Checks whether security-sensitive values in CPython's HTTP, cookie, WSGI, and URL handling modules are validated consistently across all code paths — including update methods, operator overloads, unpickling, and template substitution paths.
ReviewToolkits/cpython-security-toolkit
Command Claude Code
Generate, minimize, and validate a reproducer for a specific finding ID.
ReviewToolkits/cpython-security-toolkit
Command Claude Code
Resource amplification analysis. Checks whether CPython's decompression, parsing, and processing modules correctly bound output size and algorithmic complexity when processing attacker-controlled input.
ReviewToolkits/cpython-security-toolkit
Command Claude Code
Full security scan of a CPython source tree using all four engines.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: