| name | auditing-python-dependencies |
| description | Audit a Python project's installed dependencies for known CVEs by
wrapping pip-audit (PyPA's official vulnerability auditor) and
emitting findings in the canonical penetration-tester schema.
Detects vulnerable direct AND transitive packages, normalizes
pip-audit's severity output via OSV severity bands, falls back to
pip list --outdated when pip-audit isn't installed, and supports
requirements.txt, pyproject.toml (PEP 621), Pipfile.lock, and
poetry.lock as input sources.
Use when: pre-merge gate on a Python project, post-incident sweep
after a PyPI compromise (e.g. ctx, request-toolbelt typosquats,
ultralytics 8.3.42 compromise), SOC2 evidence collection, or
inheriting an unfamiliar Python codebase.
Threshold: any HIGH or CRITICAL CVE in the resolved dependency
tree. MODERATE / LOW reported informationally.
Trigger with: "audit python deps", "pip vulnerability scan",
"check pypi packages for CVEs", "pip-audit run".
|
| allowed-tools | ["Read","Bash(pip:*)","Bash(pip-audit:*)","Bash(python3:*)","Glob"] |
| disallowed-tools | ["Bash(rm:*)","Bash(curl:*)","Bash(wget:*)","Write(.env)","Edit(.env)","Bash(pip install:*)","Bash(pip uninstall:*)"] |
| version | 3.30.0 |
| author | Jeremy Longshore <jeremy@intentsolutions.io> |
| license | MIT |
| compatibility | Designed for Claude Code |
| tags | ["security","dependency-audit","python","pypi","cve","pentest"] |
Auditing Python Dependencies
Overview
PyPI hosts north of 500,000 packages, with several thousand new
releases every day. The package-install model is identical to npm in
the relevant ways: a pip install resolves a transitive graph,
runs each package's setup.py (which executes arbitrary Python at
install time), and writes the result to your site-packages. The CVE
attack surface is therefore the same shape: known vulnerabilities,
maintainer-account takeovers, typosquats, and protestware.
The PyPA-blessed auditor is pip-audit. It queries the Open Source
Vulnerabilities (OSV) database (which mirrors PyPA's advisory feed
plus aggregated CVE / GHSA records) and reports per-package
vulnerable versions. pip-audit integrates with requirements.txt,
pyproject.toml, Pipfile.lock, and poetry.lock, so most Python
project layouts are first-class.
This skill wraps pip-audit, normalizes its severity vocabulary to
the shared Severity enum, and emits Findings in the canonical
penetration-tester schema. If pip-audit isn't installed on the
host, the skill falls back to pip list --outdated and emits
INFO-level findings recommending the operator install pip-audit
for accurate vulnerability detection.
When the skill produces findings
| Finding | Severity | Threshold | Affected control |
|---|
| Critical CVE in installed package | CRITICAL | OSV severity band corresponds to CVSS ≥ 9.0 | CWE-1104 |
| High CVE in installed package | HIGH | OSV severity band corresponds to CVSS 7.0–8.9 | CWE-1104 |
| Medium CVE in installed package | MEDIUM | OSV severity band corresponds to CVSS 4.0–6.9 | CWE-1104 |
| Low CVE in installed package | LOW | OSV severity band corresponds to CVSS 0.1–3.9 | CWE-1104 |
| Vulnerable package with no patch | HIGH | finding has no fix_versions and severity ≥ medium | CWE-1395 |
| Outdated package (no CVE) | INFO |
