Security Antipatterns Python

Use when generating Python code for web applications, APIs, or handling user input - prevents OWASP Top 10 vulnerabilities in Django, Flask, FastAPI

5 starsSoftware Development

Install

skills CLI (Claude Code, Cursor, Codex and more)

npx skills add subhashdasyam/security-antipatterns-python --skill security-antipatterns-python

Manual install

git clone --depth 1 https://github.com/subhashdasyam/security-antipatterns-python.git /tmp/security-antipatterns-python
mkdir -p ~/.claude/skills
cp -r /tmp/security-antipatterns-python/. ~/.claude/skills/security-antipatterns-python

Personal skills live in ~/.claude/skills. Use .claude/skills in a project folder to share a skill with your team.

From the SKILL.md

# Security Anti-Patterns Guard for Python

## Overview

Code generation guard that prevents security vulnerabilities while writing Python web application code. Covers OWASP Top 10 Web (2021), OWASP API Security Top 10 (2023), with CWE references throughout.

**Stack:** Python, Django, Flask, FastAPI, SQLAlchemy, Pydantic

## When to Activate

Activate when generating code that:
- Handles user input (forms, API requests, file uploads)
- Queries databases (SQL, ORM operations)
- Performs authentication or authorization
- Manages sessions or tokens
- Processes files or paths
- Serializes/deserializes data
- Uses cryptographic operations
- Executes system commands

## Critical Rules (Top 10)

1. **NEVER** use f-strings or `.format()` in SQL queries - use parameterized queries or ORM
2. **NEVER** use `pickle.loads()` on untrusted data - use JSON with schema validation
3. **NEVER** use `eval()`, `exec()`, or `compile()` on user input
4. **NEVER** use `os.system()` or `shell=True` with user data - use `subprocess.run()` with list args
5. **NEVER** use `yaml.load()` - use `yaml.safe_load()`
6. **NEVER** hardcode secrets - use environment variables
7. **NEVER** use `random` for security - use `secrets` module
8. **NEVER** use `md5` or `sha1` for passwords - use `bcrypt` or `argon2`
9. **NEVER** trust user-supplied file paths - validate with `pathlib` and check resolved path
10. **NEVER** skip authorization checks - always verify user owns/can access the resource

## Module Index

Read the full skill on GitHub

Details

Skill name: security-antipatterns-python
Repository: subhashdasyam/security-antipatterns-python
Repo updated: 20 January 2026

FAQ

What does the Security Antipatterns Python skill do?

Use when generating Python code for web applications, APIs, or handling user input - prevents OWASP Top 10 vulnerabilities in Django, Flask, FastAPI

How do I install the Security Antipatterns Python skill?

skills CLI (Claude Code, Cursor, Codex and more): npx skills add subhashdasyam/security-antipatterns-python --skill security-antipatterns-python. Skills go in ~/.claude/skills (personal) or .claude/skills (project), and Claude loads them automatically when a task matches the description.

Is Security Antipatterns Python popular?

It lives in subhashdasyam/security-antipatterns-python, which has 5 GitHub stars and 0 forks.

Related skills

Upgrade Libxposed 102

Marukon/skill-upgrade-libxposed-102

Comprehensive guide and standard procedure for upgrading Android Xposed modules from legacy XposedBridge API (54-93) to modern LibXposed API 102 (LSPosed 1.9.3+ / Modern Xposed Module API). Use whenever the user asks to upgrade an Xposed module to API 102 or Modern Xposed API.

Software Development

Noey a Dev

KCCHDEV/coder-noey-skill

Use this skill when the user wants a careful full-stack AI coding teammate named Ney to design, implement, refactor, debug, document, and maintain web/app/game projects. Ney preserves existing code, archives instead of deleting, updates work.md for resume safety, communicates clearly in terminal-friendly summaries, and applies clean cute UI/UX plus robust backend logic.

Software Development

Use Hln API

HLnames/use-hln-api

Consult & operate against the Hyperliquid Names API. Use when your agent needs to resolve `.hl` names, reverse-resolve addresses, fetch HLN profiles or records, inspect owner or list queries, diagnose HLN API failures, prepare a mint-pass request, or guide HyperEVM dApp integration with HL Names.

Software Development

Mailbot Programmable Inbox

yopiesuryadi/mailbot-programmable-inbox

Integrate mailbot API for AI agent email automation. Create programmable inboxes, send and receive emails, track delivery events, and handle email-based workflows via API, SDK, or MCP Server. Use when building AI agents that need email identity, when setting up agent-to-human communication, when replacing Gmail or Outlook with programmatic email, or when any task involves sending, receiving, or processing emails for AI agents. Covers Node.js SDK, Python SDK, and MCP Server for Claude integration. Always use this skill when the user mentions mailbot, programmable inboxes, agent email, or email

Software Development

Web API Extractor

SH-DaWushi/web-api-extractor

Extract web API traffic through browser authentication and CDP capture, analyze endpoints, and generate a Python FastMCP server.

Software Development

Libby Book Monitor

alexpolonsky/agent-skill-libby-book-monitor

Track book availability on Libby/OverDrive libraries. Search library catalogues, manage a watchlist, and get notified when books are added. Use for "libby", "check libby", "libby watchlist", "is book on libby", "book available", "overdrive", "library catalogue", "ספרייה", "ספרים".

Software Development

Browse the most popular Claude skills, all software development skills, or write your own with the skills generator.