code-security

Python Code Security Skill

This skill combines static analysis tools with LLM-powered dynamic analysis to provide comprehensive security coverage. Static tools catch known patterns; Claude reasons about logic flaws, business rule bypasses, and context-dependent vulnerabilities that no static tool can detect.

Two-Layer Security Model

┌─────────────────────────────────────────────────────────┐
│  Layer 1: Static Analysis (Automated)                   │
│  Bandit · pip-audit · ruff S-rules · secrets detection  │
│  → Known vulnerability patterns, CVEs, exposed secrets  │
├─────────────────────────────────────────────────────────┤
│  Layer 2: LLM Dynamic Analysis (Claude)                 │
│  Code path reasoning · business logic review            │
│  → Logic flaws, auth bypasses, race conditions,         │
│    context-dependent vulnerabilities                    │
└─────────────────────────────────────────────────────────┘

---

Layer 1: Static Analysis Tools

Tool Stack

Tool	Purpose	Invocation
Bandit	Python-specific security linter (SAST)	uvx bandit -r src/
pip-audit	Dependency CVE scanner	uvx pip-audit
ruff S-rules	Bandit rules integrated in ruff	uv run ruff check --select S src/
detect-secrets	Secrets/credentials in source code	uvx detect-secrets scan
safety	Alternative dependency vulnerability check	uvx safety check

Makefile Targets

Add these targets to the project Makefile:

# =============================================================================
# Security
# =============================================================================

# Security lint (Bandit) — high severity only for CI gates
security-lint:
	uvx bandit -r src/ --severity-level high -q

# Full security lint (all severities) — for thorough review
security-lint-full:
	uvx bandit -r src/ -f json -o bandit-report.json || true
	@echo "Full report: bandit-report.json"
	uvx bandit -r src/

# Dependency vulnerability audit
pip-audit:
	uvx pip-audit -r <(uv pip freeze | grep -v -e '^-e ' -e '^$(PROJECT_NAME)==') --strict

# Secrets detection
secrets-scan:
	uvx detect-secrets scan --all-files --exclude-files '\.git/.*' | python -c "import sys,json; r=json.load(sys.stdin); findings=r.get('results',{}); exit(1) if findings else print('No secrets found.')"

# Combined security gate for CI
security-check: security-lint pip-audit secrets-scan
	@echo "All security checks passed!"