Agent skill · security · jeremylongshore
auditing-python-dependencies
Audit a Python project's installed dependencies for known CVEs by wrapping pip-audit (PyPA's official vulnerability auditor) and emitting findings in the canonical penetration-tester schema. Detects vulnerable direct AND transitive packages, normalizes pip-audit's severity output via OSV severity bands, falls back to pip list --outdated when pip-audit isn't installed, and supports requirements.txt, pyproject.toml (PEP 621), Pipfile.lock, and poetry.lock as input sources. Use when: pre-merge gate on a Python project, post-incident sweep after a PyPI compromise (e.g. ctx, request-toolbelt typosquats, ultralytics 8.3.42 compromise), SOC2 evidence collection, or inheriting an unfamiliar Python codebase. Threshold: any HIGH or CRITICAL CVE in the resolved dependency tree. MODERATE / LOW reported informationally. Trigger with: "audit python deps", "pip vulnerability scan", "check pypi packages for CVEs", "pip-audit run".
Why this skill is useful
Adds a specialized auditing capability for Python dependencies that identifies known vulnerabilities and integrates with existing project structures.
What it needs
Requires pip-audit installed locally. About 5k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Auditing Python Dependencies Overview PyPI hosts north of 500,000 packages, with several thousand new releases every day. The package-install model is identical to npm in the relevant ways: a pip install resolves a transitive graph, runs each package's setup.py (which executes arbitrary Python at install time), and writes the result to your site-packages. The CVE attack surface is therefore the same shape: known vulnerabilities, maintainer-account takeovers, typosquats, and protestware. The PyPA-blessed auditor is pip-audit. It queries the Open Source Vulnerabilities (OSV) database (which mirrors PyPA's advisory feed plus aggregated CVE / GHSA records) and reports per-package vulnerable versions. pip-audit integrates with requirements.txt, pyproject.toml, Pipfile.lock, and poetry.lock, so most Python project layouts are first-class. This skill wraps pip-audit, normalizes its severity vocabulary to the shared Severity enum, and emits Findings in the canonical penetration-tester schema. If pip-audit isn't installed on the host, the skill falls back to pip list --outdated and emits INFO-level findings recommending the operator install pip-audit for accurate vulnerability detection. When the skill produces findings Finding Severity Threshold Affected control --- --- --- --- Critical CVE in installed package CRITICAL OSV severity band corresponds to CVSS ≥ 9.0 CWE-1104 High CVE in installed package HIGH OSV severity band corresponds to CVSS 7.0–8.9 CWE-1104 Medium CVE in installed package MEDIUM OSV severity band corresponds to CVSS 4.0–6.9 CWE-1104 Low CVE in installed package LOW OSV severity band corresponds to CVSS 0.1–3.9 CWE-1104 Vulnerable package with no patch HIGH finding has no fixversions and severity ≥ medium CWE-1395 Outdated package (no CVE) INFO pip list --outdated reports a newer version (operational) pip-audit not installed INFO binary not on PATH; scanner fell back to pip list (operational) Audit DB unreachable INFO pip-audit network error reaching OSV …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/auditing-python-dependencies--19ed59