pyobfus-review

Review a Python project with pyobfus (read-only)

Your job: tell the user what protecting this project would cost them, before anyone changes a byte. You produce a judgement, not an artifact.

Boundary — read this before running anything

This skill is read-only. Within it:

• Never run an obfuscation build, not even into a temp directory.
• Never write, move, or delete project files. --check, --dry-run and --sarif are the only pyobfus modes you use here. --sarif PATH writes one report file, so only use it when the user asked for CI output and name the path they chose.
• Never run the project's own commands (tests, entry points, install steps). Nothing in a review needs to execute the user's code.
• If the user actually wants a protected build, say so plainly and switch to the pyobfus-protect skill. Do not quietly start building.

Step 1 — scan

Prefer the MCP tool if the pyobfus-mcp server is connected:

check_obfuscation_risks(path="src")

Otherwise use the CLI (pip install pyobfus):

pyobfus --check src/ --json

Both return the same shape: severity_counts, per-finding file/line/ category, detected frameworks, a suggested_preset, the effective_config that was applied, and the files that config already excludes.

The scan is config-aware by default: it reads the project's pyobfus.yaml and reports findings that the configuration already mitigates separately from the ones that still stand. Do not present a mitigated finding as an open risk.

The two front ends differ on network access, so check which one you are using before telling the user anything about it. The CLI's --check runs the dependency-hallucination advisory by default, which looks each declared dependency up on PyPI; pass --offline to skip it. The MCP tool is the opposite: it makes no network call unless you pass verify_dependencies_online=true. If the user is on a restricted network or cares that nothing leaves the machine, say --offline explicitly.