| name | python-security-research |
| description | How to research and understand Python security vulnerabilities including sandbox escapes, deserialization attacks, and Pyscript exploitation. Use this skill whenever the user mentions Python security, sandbox bypass, deserialization vulnerabilities, Pyscript hacking, Keras model attacks, or needs to understand Python-based attack vectors for security research, penetration testing, or defensive analysis. |
Python Security Research & Analysis
A skill for understanding and researching Python-based security vulnerabilities, sandbox escape techniques, and deserialization attacks.
When to Use This Skill
Use this skill when:
- Researching Python sandbox escape techniques for security assessments
- Analyzing deserialization vulnerabilities in Python applications
- Investigating Pyscript security issues in web applications
- Understanding Keras model deserialization RCE risks
- Learning Python web request patterns for security testing
- Conducting defensive security analysis of Python codebases
- Preparing for security certifications or training
Core Concepts
Python Sandbox Escapes
Python sandboxes are often used to restrict code execution, but they can be bypassed through various techniques:
Common bypass vectors:
- Import restrictions can be circumvented via
__import__ or importlib
- Built-in function restrictions may be bypassed through
__builtins__ manipulation
- File system access can sometimes be gained through
open() or exec()
- Network access restrictions may be bypassed via
socket or urllib
Research approach:
- Identify the sandbox implementation (restricted python, custom sandbox, etc.)
