A Claude Code plugin for finding semantic security flaws in CPython's standard library — archive extraction boundaries, validation coverage gaps, resource amplification, and audit hook bypass.
ReviewToolkits/cpython-security-toolkit
Command
Archive extraction boundary analysis. Checks whether CPython's tarfile, zipfile, and shutil.unpackarchive implementations correctly enforce the invariant that no extraction path may write outside the declared destination directory.
ReviewToolkits/cpython-security-toolkit
Command
Audit hook coverage analysis. Checks whether CPython's file-loading and shell-calling paths correctly emit sys.audit() events and whether security controls depending on those events can be bypassed via alternative code paths.
ReviewToolkits/cpython-security-toolkit
Command
Protocol validation coverage analysis. Checks whether security-sensitive values in CPython's HTTP, cookie, WSGI, and URL handling modules are validated consistently across all code paths — including update methods, operator overloads, unpickling, and template substitution paths.
ReviewToolkits/cpython-security-toolkit
Command
Generate, minimize, and validate a reproducer for a specific finding ID.
ReviewToolkits/cpython-security-toolkit
Command
Resource amplification analysis. Checks whether CPython's decompression, parsing, and processing modules correctly bound output size and algorithmic complexity when processing attacker-controlled input.
ReviewToolkits/cpython-security-toolkit
Command
Full security scan of a CPython source tree using all four engines.