菜单
Python AST-based security analysis using Bandit. Detects exec/eval code execution, pickle/yaml deserialization, subprocess shell injection, SQL injection, hardcoded credentials, weak cryptography. Use for Python security audits, malicious code triage.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Multi-language pattern-based security scanner using grep signature databases. Primary use for secrets detection, command injection patterns, and first-pass security scans on unknown codebases. Supports 15+ languages.
Detect malicious packages and supply chain attacks in Python (PyPI) and Node.js (npm). Scans requirements.txt, package.json, package-lock.json for malware, typosquatting, data exfiltration, and compromised maintainers.
Shell script static analysis using ShellCheck. Detects command injection, unquoted variables, reverse shell patterns, dangerous rm operations, obfuscated payloads. Combine with graudit for patterns ShellCheck may miss.
Comprehensive security scanner for filesystems, container images, and IaC. Detects known CVEs in dependencies, hardcoded secrets, and IaC misconfigurations in Terraform, Kubernetes, Dockerfiles, and CloudFormation.
Domain knowledge for extracting headlines from major international news outlets. Covers which tool to use per site, URL patterns, timestamp formats, and filtering rules.
| name | bandit-security-scan |
| description | Python AST-based security analysis using Bandit. Detects exec/eval code execution, pickle/yaml deserialization, subprocess shell injection, SQL injection, hardcoded credentials, weak cryptography. Use for Python security audits, malicious code triage. |
| applyTo | **/*.py |
Bandit is a security linter for Python code. It builds an AST from each file and runs plugins against the nodes to detect common vulnerabilities.
# Scan directory recursively
bandit -r /path/to/project
# JSON output (recommended for parsing)
bandit -r . -f json -o bandit-results.json
# Only HIGH severity findings
bandit -r . -lll
# Only MEDIUM and above
bandit -r . -ll
# Run specific critical tests only
bandit -r . -t B102,B307,B602,B605,B301 -lll
# Exclude test directories
bandit -r . --exclude "*/tests/*,*/venv/*"
| Test ID | Detection | Severity | MITRE ATT&CK |
|---|---|---|---|
| B102 | exec() usage | MEDIUM | T1059 |
| B307 | eval() usage | MEDIUM | T1059 |
| B602 | subprocess(shell=True) | HIGH | T1059.004 |
| B605 | os.system() | HIGH | T1059.004 |
| B301 | pickle.load() | MEDIUM | T1059 |
| B105-B107 | Hardcoded passwords | LOW | T1552.001 |
| B310 | urllib.urlopen | MEDIUM | T1071 |
| B312 | telnetlib | HIGH | T1071 |
| B501 | request_with_no_cert_validation | HIGH | T1557 |
| B506 | yaml.load() | MEDIUM | T1059 |
| B608 | Hardcoded SQL expressions | MEDIUM | T1190 |
Quick triage (< 30 seconds):
bandit -r . -t B102,B307,B602,B605 -lll
Standard audit:
bandit -r . -ll --exclude "*/tests/*,*/venv/*"
Full malicious code scan:
bandit -r . -f json -o full-scan.json
| Test ID | Scenario | Mitigation |
|---|---|---|
| B101 | assert in test files | --exclude "*/tests/*" |
| B311 | random for non-security use | Skip with -s B311 |
| B105 | Variables named password that aren't credentials | Manual review |
guarddog or pip-audit for that