ReviewToolkits

Cpython Security Toolkit — Security skill for Claude Code

Security community

A Claude Code plugin for finding semantic security flaws in CPython's standard library — archive extraction boundaries, validation coverage gaps, resource amplification, and audit hook bypass.

How to install Cpython Security Toolkit

This entry records only its repository, not the path inside it, so there is no exact command to give. Open ReviewToolkits/cpython-security-toolkit and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Cpython Security Toolkit does

A Claude Code plugin for finding semantic security flaws in CPython's standard library — archive extraction boundaries, validation coverage gaps, resource amplification, and audit hook bypass.

Alternatives in Security

Security Threat Model — Generate repo-specific threat models identifying trust boundaries 14.6k ★
Security Guidance — Hook that warns about command injection, XSS, and unsafe patterns 14k ★
Security Guardian — Comprehensive security analysis for RTK CLI tool, focusing on command injection, shell escaping, hook security 11.9k ★

README

CPython Security Toolkit

A [Claude Code](https://docs.anthropic.com/en/docs/claude-code) plugin for finding semantic security flaws in CPython's standard library — the class of bug that generic SAST tools, fuzzers, and sanitizers do not model well.

Built around CPython-specific security invariants: archive extraction boundaries, protocol validation coverage, resource amplification ratios, and audit hook gaps. Every detector is anchored to a confirmed historical CVE; every finding requires a runnable reproducer before it reaches a maintainer.

⚠️ Read this before you use this toolkit on CPython

This tool finds **security vulnerabilities** in CPython's standard library. Security findings are handled differently from correctness bugs.

Read WORKING_WITH_MAINTAINERS.md. It is the most important document in this repository.
Security findings go to security@python.org first — never the public issue tracker. See the CPython security policy.
Pre-triage with a trusted CPython developer before submitting. One private message — "I found something that might be a security issue in tarfile, can you take a look?" — takes five minutes and saves everyone time.
Never file a finding without a runnable reproducer. A finding with no reproducer is not a finding. The tool enforces this.
Concise and objective reports only. CPython maintainers are busy. One clear sentence describing the violated invariant is worth more than three paragraphs of analysis.

Why a Separate Tool?

Concern	cpython-review-toolkit	cpython-security-toolkit
Layer	C source (Modules/, Objects/, Python/)	Python stdlib (Lib/)
Question asked	"Is this C implementation correct?"	"Does this stdlib behavior violate a security invariant?"
Bug class	Refcount leaks, null safety, error paths	Archive escapes, validation bypass, resource ampl