Security antipatterns python

Skill subhashdasyam/security-antipatterns-python

Claude Code or Codex Skill that teaches AI coding agents to write secure Python. Catches SQL injection, pickle attacks, hardcoded secrets, and other OWASP Top 10 patterns in Django, Flask, and FastAPI code.

Install

npx -y skills add subhashdasyam/security-antipatterns-python

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
5 stars5 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Use when generating Python code for web applications, APIs, or handling user input - prevents OWASP Top 10 vulnerabilities in Django, Flask, FastAPI

SKILL.md

4.7 KB, ~1.1k tokens by cl100k_base, as published. Nobody here has run it

Security Anti-Patterns Guard for Python

Overview

Code generation guard that prevents security vulnerabilities while writing Python web application code. Covers OWASP Top 10 Web (2021), OWASP API Security Top 10 (2023), with CWE references throughout.

Stack: Python, Django, Flask, FastAPI, SQLAlchemy, Pydantic

When to Activate

Activate when generating code that:

Handles user input (forms, API requests, file uploads)
Queries databases (SQL, ORM operations)
Performs authentication or authorization
Manages sessions or tokens
Processes files or paths
Serializes/deserializes data
Uses cryptographic operations
Executes system commands

Critical Rules (Top 10)

NEVER use f-strings or .format() in SQL queries - use parameterized queries or ORM
NEVER use pickle.loads() on untrusted data - use JSON with schema validation
NEVER use eval(), exec(), or compile() on user input
NEVER use os.system() or shell=True with user data - use subprocess.run() with list args
NEVER use yaml.load() - use yaml.safe_load()
NEVER hardcode secrets - use environment variables
NEVER use random for security - use secrets module
NEVER use md5 or sha1 for passwords - use bcrypt or argon2
NEVER trust user-supplied file paths - validate with pathlib and check resolved path
NEVER skip authorization checks - always verify user owns/can access the resource

Module Index

Module	Focus	Key Vulnerabilities
references/injection.md	SQL, Command, Template, LDAP	CWE-89, CWE-78, CWE-90, CWE-1336
references/deserialization.md	pickle, yaml, marshal	CWE-502
references/xss-output.md	XSS, template escaping	CWE-79
references/auth-access.md	BOLA, BFLA, sessions	CWE-862, CWE-863, CWE-287
references/crypto-secrets.md	Secrets, hashing, encryption	CWE-798, CWE-327, CWE-916
references/input-validation.md	Pydantic, forms, uploads	CWE-20, CWE-434, CWE-915
references/file-operations.md	Path traversal, temp files	CWE-22, CWE-377
references/django-security.md	CSRF, settings, ORM	Django-specific
references/fastapi-flask.md	Auth, CORS, validation	FastAPI/Flask-specific
references/dependencies.md	pip audit, typosquatting	CWE-1104, CWE-1357
references/python-runtime.md	eval/exec, ReDoS	CWE-94, CWE-1333

Quick Decision Tree

User input involved?
├─ Database query → See references/injection.md (use ORM/parameterized)
├─ File path → See references/file-operations.md (use pathlib + resolve check)
├─ Command execution → See references/injection.md (subprocess with list args)
├─ Deserialization → See references/deserialization.md (NEVER pickle untrusted)
├─ Template rendering → See references/xss-output.md (auto-escape enabled)
└─ API endpoint → See references/auth-access.md + references/input-validation.md

Storing/generating secrets?
├─ API keys → See references/crypto-secrets.md (env vars)
├─ Passwords → See references/crypto-secrets.md (bcrypt/argon2)
└─ Tokens → See references/crypto-secrets.md (secrets module)

Framework-specific?
├─ Django → See references/django-security.md
├─ FastAPI → See references/fastapi-flask.md
└─ Flask → See references/fastapi-flask.md

How to Use This Skill

During code generation: Reference relevant module for specific vulnerability patterns
Code review: Check generated code against patterns in each module
When uncertain: Default to the more secure option; add explicit comments explaining security decisions

Sources

What ships with it: 13 files

69.6 KB alongside SKILL.md

references/

marketplace.json3.1 KB
README.md3.3 KB

Gives 2 of the 12 instructions most security skills give in ~1.1k tokens

Counted across 648 of the 828 authors here whose files we hold, read 2026-08-07

Parameterize all database queriesin 68 of 648, across 51 files
Hash passwords using bcrypt, scrypt, or argon2here, and in 49 of 648, across 36 files
Apply rate limiting to authentication endpointsin 48 of 648, across 24 files
Configure security headersin 35 of 648, across 19 files
Validate all inputsin 32 of 648, across 24 files
Validate all external input at the system boundaryin 29 of 648, across 19 files
Run containers as a non-root userin 28 of 648, across 15 files
Use httponly secure samesite cookies for sessionsin 26 of 648, across 15 files
Run dependency audits before every releasein 21 of 648, across 10 files
Encode output to prevent cross-site scriptingin 21 of 648, across 11 files
Copy dependencies before source codein 20 of 648, across 9 files
Store secrets in environment variableshere, and in 20 of 648, across 18 files

Said here and by no other author read

validate deserialized data with a schema
use subprocess with list arguments
default to the more secure option
explain security decisions in comments

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.