Not in the top 1,000 by GitHub stars

ParzivalHack/PySpector

PySpector is a static analysis security testing (SAST) Framework engineered for modern Python development workflows. It leverages a powerful Rust core to deliver high-speed, accurate vulnerability scanning, wrapped in a developer-friendly Python CLI.

Security Engineering Testing

History

Review weekly changes to SKILL.md before updating. Dates mark the weeks in which we observed each version; checks apply to the recorded commits.

View weekly changes

`SKILL.md`

Week of Nov 2, 2026 · +0 / −0 lines

Before Network or broad shell → After Network or broad shell

3b4fb2354899 → 3b4fb2354899

Compare on GitHub

Week of Oct 26, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → 3b4fb2354899

No earlier version was observed for comparison.

Compare on GitHub

View on GitHub Add to my skills

Verified commit 3b4fb2354899c41cdf0d019e46d627680863535d

153GitHub stars

0stars in 7 days

1skill in this repository

8commits in 30 days

Heat

1.5

Star growth, last 7 daysNot available
Star growth, last 24 hoursNot available
Rank movement, last 7 daysNot available
Commits, last 30 daysNot available
Accounts asking about it through MCP, last 7 daysNot available
Hot votes this weekNot available

Heat never changes the order by stars, and sponsorship never touches it. How heat works

Stars over time

30-day change not yet available: not enough history.

Individual skills in this repository

pyspector-security-audit /

How it works

pyspector-security-audit

When your agent uses it

Run a full Python codebase security audit using PySpector (https://github.com/ParzivalHack/PySpector), a Rust-core SAST scanner. Use this skill whenever the user asks for a security audit, vulnerability scan, SAST scan, code security review, or dependency/CVE check of a Python codebase or repository, including phrasing like "check this repo for vulnerabilities," "is my code secure," "audit my project," "scan for CVEs," or "find security issues." Also trigger if the user mentions PySpector by name for any reason (install, upgrade, run, configure). This skill installs PySpector (including its required Rust toolchain) if missing, selects scan flags based on what the codebase actually looks like, runs the scan, verifies findings against the real source before reporting them, and produces a report the user can read. Do not use this skill for non-Python codebases, for generic code review unrelated to security, or for fixing/patching vulnerabilities after the report already exists (that's a normal coding task).

What it loads into context

Frontmatter

229 tokens

Always available to the agent

SKILL.md

3,172 tokens

When the skill is activated

Reference documents

13,290 tokens

Loaded on request

Token counts are estimates. Scripts run separately; they are not counted as reference context.

The playbook

Workflow overview
Step 1: Check for / install PySpector
Step 2: Verify the install
Step 3: Learn the current CLI
Step 4: Recon the codebase before choosing flags
Step 5: Run the scan
Step 6: Verify findings before reporting (static re-verification)
Step 7: Report
Notes / gotchas

Scripts executed separately

Dockerfile
benchmarks/speed/benchmark.sh
benchmarks/speed/benchmarkgraph.py
scripts/setup_cron.sh
setup.py
src/pyspector/__init__.py
src/pyspector/_ast_encode.py
src/pyspector/_parallel.py
src/pyspector/ast_cache.py
src/pyspector/cli.py
src/pyspector/config.py
src/pyspector/messages.py
src/pyspector/reporting.py
src/pyspector/rules/__init__.py
src/pyspector/stats.py
src/pyspector/triage.py
tests/examples/hardcoded_anthropic_key.py
tests/unit/ast_cache_test.py
tests/unit/reporting_test.py
tests/unit/test_a_sink_rules.py
tests/unit/test_ai_rules.py
tests/unit/test_config.py
tests/unit/test_false_positive_reductions.py
tests/unit/test_frontend_parallel.py
tests/unit/test_get_asts.py
tests/unit/test_group_a_rules.py
tests/unit/test_missing_rules.py
tests/unit/test_semantic_provenance.py
tests/unit/test_symlink_containment.py
tests/unit/test_taint_engine_extension.py

Files

.dockerignoreasset284 bytes
.github/SECURITY.mddoc11,340 bytes
.gitignoreasset929 bytes
.pre-commit-config.yamlasset1,553 bytes
.pre-commit-hooks.yamlasset252 bytes
.satori.ymlasset1,171 bytes
CODE_OF_CONDUCT.mddoc5,226 bytes
CONTRIBUTING.mddoc5,866 bytes
Cargo.tomlasset459 bytes
Dockerfileruns1,580 bytes
LICENSEasset11,357 bytes
MANIFEST.inasset290 bytes
NOTICE.mddoc693 bytes
README.mddoc27,320 bytes
SKILL.mdcore13,905 bytes
SKILL.mdcore13,905 bytes
SKILL.mdcore13,905 bytes
SKILL.mdcore13,905 bytes
SKILL.mdcore13,905 bytes
SKILL.mdcore13,905 bytes
SKILL.mdcore13,905 bytes
SKILL.mdcore13,905 bytes
SKILL.mdcore13,905 bytes
SKILL.mdcore13,905 bytes
SKILL.mdcore13,905 bytes
SKILL.mdcore13,905 bytes
SKILL.mdcore13,905 bytes
SKILL.mdcore13,905 bytes
SKILL.mdcore13,905 bytes
benchmarks/speed/bandit.ymlasset794 bytes
benchmarks/speed/benchmark.shruns23,665 bytes
benchmarks/speed/benchmark_results_20260828_132828.csvasset1,050 bytes
benchmarks/speed/benchmarkfulloutputandrawdata.txtdoc41,263 bytes
benchmarks/speed/benchmarkgraph.pyruns12,934 bytes
benchmarks/speed/benchmarkresultscreenshot.pngasset245,901 bytes
benchmarks/speed/fastapi_fastapi_bandit_run5_20260828_145113.logasset254 bytes
benchmarks/speed/pyspector.ymlasset1,439 bytes
benchmarks/speed/pyspector_benchmark_graphs.pngasset504,183 bytes
benchmarks/speed/semgrep.ymlasset976 bytes
image.pngasset28,090 bytes
index.htmlasset127,615 bytes
logo.pngasset91,169 bytes
pyproject.tomlasset638 bytes
requirements.txtdoc223 bytes
scripts/setup_cron.shruns1,740 bytes
setup.cfgasset155 bytes
setup.pyruns1,711 bytes
src/main.rsasset6,038 bytes
src/pyspector/__init__.pyruns0 bytes
src/pyspector/_ast_encode.pyruns4,646 bytes
src/pyspector/_parallel.pyruns4,699 bytes
src/pyspector/_rust_core/Cargo.tomlasset538 bytes
src/pyspector/_rust_core/src/analysis/ast_analysis.rsasset4,461 bytes
src/pyspector/_rust_core/src/analysis/config_analysis.rsasset3,407 bytes
src/pyspector/_rust_core/src/analysis/mod.rsasset7,568 bytes
src/pyspector/_rust_core/src/analysis/taint_analysis.rsasset97,244 bytes
src/pyspector/_rust_core/src/ast_parser.rsasset736 bytes
src/pyspector/_rust_core/src/graph/call_graph_builder.rsasset8,388 bytes
src/pyspector/_rust_core/src/graph/cfg_builder.rsasset6,517 bytes
src/pyspector/_rust_core/src/graph/mod.rsasset72 bytes
src/pyspector/_rust_core/src/graph/representation.rsasset1,885 bytes
src/pyspector/_rust_core/src/issues.rsasset2,014 bytes
src/pyspector/_rust_core/src/lib.rsasset5,335 bytes
src/pyspector/_rust_core/src/rules.rsasset8,923 bytes
src/pyspector/_rust_core/src/supply_chain.rsasset21,441 bytes
src/pyspector/ast_cache.pyruns23,380 bytes
src/pyspector/cli.pyruns45,416 bytes
src/pyspector/config.pyruns3,117 bytes
src/pyspector/messages.pyruns3,352 bytes
src/pyspector/reporting.pyruns8,974 bytes
src/pyspector/rules/__init__.pyruns0 bytes
src/pyspector/rules/built-in-rules-ai.tomlasset22,799 bytes
src/pyspector/rules/built-in-rules.tomlasset108,030 bytes
src/pyspector/stats.pyruns11,082 bytes
src/pyspector/triage.pyruns9,741 bytes
tests/examples/hardcoded_anthropic_key.pyruns95 bytes
tests/unit/ast_cache_test.pyruns26,345 bytes
tests/unit/reporting_test.pyruns13,558 bytes
tests/unit/test_a_sink_rules.pyruns7,361 bytes
tests/unit/test_ai_rules.pyruns17,530 bytes
tests/unit/test_config.pyruns2,691 bytes
tests/unit/test_false_positive_reductions.pyruns17,715 bytes
tests/unit/test_frontend_parallel.pyruns10,028 bytes
tests/unit/test_get_asts.pyruns3,084 bytes
tests/unit/test_group_a_rules.pyruns9,718 bytes
tests/unit/test_missing_rules.pyruns18,853 bytes
tests/unit/test_semantic_provenance.pyruns8,001 bytes
tests/unit/test_symlink_containment.pyruns2,401 bytes
tests/unit/test_taint_engine_extension.pyruns10,380 bytes

Read SKILL.md


# PySpector Security Audit

Drive an end-to-end Python codebase security audit with PySpector: install, verify, learn the CLI, recon the codebase, scan with the right flags, verify, report.

PySpector is a Rust-core, Python-CLI SAST tool with a flow-sensitive, inter-procedural taint engine. Its ruleset spans regex (secrets/config), AST (anti-patterns), and graph/taint (data-flow vulnerability chains), plus optional AI/LLM-specific rules and dependency CVE checks. Full project context: https://github.com/ParzivalHack/PySpector

## Workflow overview

1. Check for an existing install; install if missing (including Rust)
2. Confirm the install actually works
3. Read `pyspector --help` and `pyspector scan --help` to get the real, current flag set. Never assume flags from this document alone
4. Recon the target codebase to decide which optional rulesets apply
5. Run the scan(s) with the right flags
6. Statically re-verify the findings that matter before reporting anything

View the complete source on GitHub

Skills included

pyspector-security-audit

Repository facts

License: Apache-2.0
Created: Aug 9, 2023
Last pushed: Oct 20, 2026
Forks: 42
Open issues: 4
Project activity: Active

Before you install

Network or broad shell

Automated signals, not a guarantee

Checked Nov 6, 2026

Not fully analyzed: some files were too long, unreadable or missing. This never lowers the level.

Show 14 notes

SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed

No broad tool permissions
20 dangerous shell commandsin 10 files: Dockerfile:6 src/pyspector/rules/built-in-rules.toml:1066 index.html:1432 and 7 more
345 network referencesin 23 files: index.html:12 src/pyspector/rules/built-in-rules.toml:749 README.md:1 and 20 more
4 obfuscation signalsin 3 files: src/pyspector/ast_cache.py:226 tests/unit/test_false_positive_reductions.py:360 tests/unit/test_get_asts.py:31
No instruction overrides
30 executable scriptsin 30 files: Dockerfile:1 benchmarks/speed/benchmark.sh:1 benchmarks/speed/benchmarkgraph.py:1 and 27 more
46 references to secretsin 12 files: src/pyspector/rules/built-in-rules.toml:100 src/pyspector/_rust_core/src/analysis/taint_analysis.rs:37 tests/unit/test_frontend_parallel.py:94 and 9 more
No requests to vote in Hot

Show all 445 signals by file

`.dockerignore`

Access to secretsline 17
```
[Credential-related source omitted]
```

`.github/SECURITY.md`

Network accessline 8

All security issues must be reported **privately** through **GitHub Security Advisories**:   [**Report a Vulnerability here**](https://github.com/ParzivalHack/PySpector/security/advisories/new)

Network accessline 9

[**Report a Vulnerability here**](https://github.com/ParzivalHack/PySpector/security/advisories/new)

`.gitignore`

Access to secretsline 53
```
[Credential-related source omitted]
```

`.pre-commit-config.yaml`

Network accessline 4

repos:   - repo: https://github.com/pre-commit/pre-commit-hooks

Network accessline 5

- repo: https://github.com/pre-commit/pre-commit-hooks

Network accessline 12

- repo: https://github.com/astral-sh/ruff-pre-commit

Network accessline 25

- repo: https://github.com/pre-commit/mirrors-mypy

Network accessline 33

- repo: https://github.com/Yelp/detect-secrets

Network accessline 41

- repo: https://github.com/commitizen-tools/commitizen

`.satori.yml`

Network accessline 28

# Don't throw SyntaxWarnings     SyntaxWarning:       - pyspector scan --url=https://github.com/Instagram/LibCST

Network accessline 30

- pyspector scan --url=https://github.com/Instagram/LibCST

Network accessline 32

# Don't throw Tracebacks     Traceback:       - pyspector scan --url=https://github.com/google/python-fire

Network accessline 34

- pyspector scan --url=https://github.com/google/python-fire

Network accessline 37

assertReturnCodeNot: 0       url:         - pyspector scan --url=https://github.com.attacker.com/some/thing

Network accessline 39

- pyspector scan --url=https://github.com.attacker.com/some/thing

`CODE_OF_CONDUCT.md`

Network accessline 117

This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 2.0, available at https://www.contributor-covenant.org/version/2/0/code_of_conduct.html.

Network accessline 119

https://www.contributor-covenant.org/version/2/0/code_of_conduct.html.

Network accessline 121

Community Impact Guidelines were inspired by [Mozilla's code of conduct enforcement ladder](https://github.com/mozilla/diversity).

Network accessline 122

enforcement ladder](https://github.com/mozilla/diversity).

Network accessline 124

[homepage]: https://www.contributor-covenant.org

Network accessline 126

For answers to common questions about this code of conduct, see the FAQ at https://www.contributor-covenant.org/faq. Translations are available at

Network accessline 127

https://www.contributor-covenant.org/faq. Translations are available at

Network accessline 128

https://www.contributor-covenant.org/translations.

`CONTRIBUTING.md`

Network accessline 1

<div id="header" align="center">   <img src="https://media.giphy.com/media/YRMb6dd7zprS00JdGZ/giphy.gif" width="100"/>

Network accessline 2

<img src="https://media.giphy.com/media/YRMb6dd7zprS00JdGZ/giphy.gif" width="100"/>

Network accessline 17

* **Reporting Bugs**: If you find something that isn't working as expected, please [open an issue](https://github.com/ParzivalHack/PySpector/issues).

Network accessline 18

* **Suggesting Enhancements**: Have an idea for a new feature or a way to improve an existing one? We'd love to hear it. * **Writing New Rules**: The heart of PySpector is its ruleset. Adding new rules to detect vulnerabilities is one of th

Network accessline 20

* **Improving the Code**: If you see an opportunity to improve the Python or Rust code, feel free to [submit a PR](https://github.com/ParzivalHack/PySpector/pulls).

Network accessline 30

1.  **Python**: Python 3.9 or newer is required (Python 3.14 is recommended). You can check your Python version by running `python --version`. 2.  **Rust**: The core engine of PySpector is written in Rust. Install it via [rustup](https://ru

Network accessline 31

2.  **Rust**: The core engine of PySpector is written in Rust. Install it via [rustup](https://rustup.rs/) and verify with `rustc --version` and `cargo --version`.

Network accessline 35

1.  **Fork Pyspector and Clone your Repository**:     ```bash     git clone https://github.com/YOURUSERNAME/PySpector.git

Network accessline 36

```bash     git clone https://github.com/YOURUSERNAME/PySpector.git     cd PySpector

Network accessline 37

git clone https://github.com/YOURUSERNAME/PySpector.git

Dangerous shell operationline 160

remediation = "Avoid using eval(). Use safer alternatives like ast.literal_eval or explicit parsing."

Network accessline 179

git push origin my-new-rule     ``` 4.  [**Open a Pull Request**](https://github.com/ParzivalHack/PySpector/pulls) on the main PySpector repository. Please provide a clear description of what you've done.

Network accessline 181

4.  [**Open a Pull Request**](https://github.com/ParzivalHack/PySpector/pulls) on the main PySpector repository. Please provide a clear description of what you've done.

`Dockerfile`

Executable scriptline 1
```
Executable file
```

Network accessline 3

RUN apt-get update && apt-get install -y \     curl build-essential pkg-config libssl-dev git

Network accessline 4

curl build-essential pkg-config libssl-dev git

Dangerous shell operationline 6

RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y

Network accessline 6

RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y

Dangerous shell operationline 22

RUN apt-get update && apt-get install -y      git      curl      build-essential      pkg-config      libssl-dev      && rm -rf /var/lib/apt/lists/*

Network accessline 22

RUN apt-get update && apt-get install -y \     git \     curl \

Network accessline 23
```
git \     curl \     build-essential \
```
Network accessline 24
```
curl \
```
Dangerous shell operationline 28
```
&& rm -rf /var/lib/apt/lists/*
```

Dangerous shell operationline 31

RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y

Network accessline 31

RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y

`LICENSE`

Network accessline 1

Apache License                            Version 2.0, January 2004                         http://www.apache.org/licenses/

Network accessline 3
```
http://www.apache.org/licenses/
```

Network accessline 195

http://www.apache.org/licenses/LICENSE-2.0

`NOTICE.md`

Network accessline 7

You may obtain a copy of the License at: http://www.apache.org/licenses/LICENSE-2.0

Network accessline 8

http://www.apache.org/licenses/LICENSE-2.0

`README.md`

Network accessline 1

<img width="2048" height="681" alt="image" src="https://github.com/user-attachments/assets/0093a5d2-d1c9-45dd-b129-2de196f3be1f" />

Network accessline 5

[![Awesome](https://awesome.re/badge.svg)](https://github.com/ritwiktiwari/awesome-python-rs)

Network accessline 6

[![Powered By](https://img.shields.io/badge/Powered%20By-SecurityCert-purple)](https://www.securitycert.it/)

Network accessline 7

[![Total PyPI Downloads](https://static.pepy.tech/badge/pyspector)](https://pepy.tech/project/pyspector)

Network accessline 8

[![PyPI Downloads](https://static.pepy.tech/personalized-badge/pyspector?period=weekly&units=INTERNATIONAL_SYSTEM&left_color=GRAY&right_color=BLUE&left_text=downloads%2Fweek)](https://pepy.tech/projects/pyspector)

Network accessline 9

[![latest release](https://img.shields.io/badge/latest%20release-v0.2.2--beta-blue)](https://github.com/ParzivalHack/PySpector/releases/tag/v0.2.2-beta)

Network accessline 10

[![PyPI version](https://img.shields.io/pypi/v/pyspector?color=blue&label=pypi%20package)](https://pypi.org/project/pyspector/)

Network accessline 11

[![Python version](https://img.shields.io/badge/Python-3.9%2B-blue?logo=python&logoColor=white)](https://www.python.org/)

Network accessline 12

[![Rust version](https://img.shields.io/badge/Rust-stable-orange?logo=rust&logoColor=white)](https://www.rust-lang.org/)

Network accessline 13

[![CodeQL Status](https://github.com/ParzivalHack/PySpector/workflows/CodeQL/badge.svg)](https://github.com/ParzivalHack/PySpector/actions/workflows/github-code-scanning/codeql)

Network accessline 14

[![Trusted By](https://img.shields.io/badge/Trusted_By-SatoriCI-97ca00?logo=data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9Im5vIj8+CjwhLS0gR2VuZXJhdG9yOiBBZG9iZSBJbGx1c3RyYXRvciAxNi4wLjAsIFNWRyBFeH

Network accessline 15

[![Discord](https://img.shields.io/discord/783304196072931329?label=Online&logo=discord&logoColor=white&color=5865F2)](https://discord.gg/dPq2N34hts)

Network accessline 42

https://github.com/user-attachments/assets/d91b9d8a-4411-4f90-84bd-69852d27a5b5

Network accessline 48

- **Python**: Python 3.9 – 3.14 supported (Python 3.9 or newer, up to 3.14). - **Rust**: The Rust compiler (`rustc`) and Cargo package manager are required. You can easily install the **Rust toolchain** via [rustup](https://rustup.rs/) and

Network accessline 49

- **Rust**: The Rust compiler (`rustc`) and Cargo package manager are required. You can easily install the **Rust toolchain** via [rustup](https://rustup.rs/) and verify your installation by running `cargo --version`.

Network accessline 129

You can read and download for free the full technical whitepaper here: [PySpector Performance Benchmark: A Comparative Speed and Resource-Efficiency Analysis Against Bandit and Semgrep Across Eight Open-Source Python Codebases.pdf](https://

Network accessline 130

[PySpector Performance Benchmark: A Comparative Speed and Resource-Efficiency Analysis Against Bandit and Semgrep Across Eight Open-Source Python Codebases.pdf](https://github.com/user-attachments/files/31597398/PySpector.Performance.Benchm

Network accessline 135

<img width="3780" height="2190" alt="pyspector_benchmark_graphs" src="https://github.com/user-attachments/assets/6d45ff1a-6cae-4e0c-946c-1418b76d438a" />

Network accessline 170

_Full benchmark data, including raw per-run results, and the exact tool configurations, is available in [benchmarks/speed](https://github.com/ParzivalHack/PySpector/tree/main/benchmarks/speed) for transparency and reproducibility._

Network accessline 201

pyspector scan --url https://github.com/username/repo.git

Network accessline 206

<img width="864" height="1098" alt="image" src="https://github.com/user-attachments/assets/5094fef9-73d1-4d34-b530-9498d923a514" />

Network accessline 255

<img width="970" height="1096" alt="image" src="https://github.com/user-attachments/assets/14bac1c0-eae2-4dab-ab40-8047b46bbac8" />

Network accessline 265

<img width="954" height="962" alt="image" src="https://github.com/user-attachments/assets/f2ce535f-84d6-4a8a-8399-0666b7806da3" />

Network accessline 275

<img width="871" height="950" alt="image" src="https://github.com/user-attachments/assets/8ad8e8b9-528a-426f-96e3-c0a66c2c683d" />

Network accessline 295

PySpector ships with a `SKILL.md`, following the [Agent Skills](https://github.com/anthropics/skills) format supported by agents such as Claude Code, OpenAI Codex, Google Antigravity, and other agentic coding tools. It allows your agent to

Network accessline 299

<img width="1600" height="253" alt="image" src="https://github.com/user-attachments/assets/de539a62-8a7e-4674-a77d-264e0ef42ca0" />

Network accessline 332

"driver": {           "name": "PySpector",           "informationUri": "https://github.com/ParzivalHack/PySpector"

Network accessline 333

"name": "PySpector",           "informationUri": "https://github.com/ParzivalHack/PySpector"         }

Network accessline 334

"informationUri": "https://github.com/ParzivalHack/PySpector"

Network accessline 365

To ensure that no new high-severity issues enter your codebase, you can set up a Git pre-commit hook using the [pre-commit](https://pre-commit.com) framework. The hook will scan your staged Python files before each commit and block it if an

Network accessline 370

repos:   - repo: https://github.com/ParzivalHack/PySpector

Network accessline 371

- repo: https://github.com/ParzivalHack/PySpector

Network accessline 401

<tbody>     <tr>       <td align="center" valign="top" width="14.28%"><a href="https://satori.ci/"><img src="https://avatars.githubusercontent.com/u/89515805?v=4?s=100" width="100px;" alt="satoridev01"/><br /><sub><b>satoridev01</b></sub></

Network accessline 402

<tr>       <td align="center" valign="top" width="14.28%"><a href="https://satori.ci/"><img src="https://avatars.githubusercontent.com/u/89515805?v=4?s=100" width="100px;" alt="satoridev01"/><br /><sub><b>satoridev01</b></sub></a><br /><a h

Network accessline 403

<td align="center" valign="top" width="14.28%"><a href="https://satori.ci/"><img src="https://avatars.githubusercontent.com/u/89515805?v=4?s=100" width="100px;" alt="satoridev01"/><br /><sub><b>satoridev01</b></sub></a><br /><a href="#secur

Network accessline 404

<td align="center" valign="top" width="14.28%"><a href="https://github.com/Shinigami81"><img src="https://avatars.githubusercontent.com/u/122274261?v=4?s=100" width="100px;" alt="Shinigami"/><br /><sub><b>Shinigami</b></sub></a><br /><a hre

Network accessline 405

<td align="center" valign="top" width="14.28%"><a href="https://youtube.com/fantasm"><img src="https://avatars.githubusercontent.com/u/35772301?v=4?s=100" width="100px;" alt="fg0x0"/><br /><sub><b>fg0x0</b></sub></a><br /><a href="#security

Network accessline 406

<td align="center" valign="top" width="14.28%"><a href="https://github.com/arpitjain099"><img src="https://avatars.githubusercontent.com/u/3242828?v=4?s=100" width="100px;" alt="arpitjain099"/><br /><sub><b>arpitjain099</b></sub></a><br /><

Network accessline 416

This project follows the [all-contributors](https://github.com/all-contributors/all-contributors) specification.

Network accessline 430

Yes. PySpector includes a Rust analysis core, so local installation from source requires the Rust toolchain. Install Rust with [rustup](https://rustup.rs/), then verify the setup with `cargo --version` before installing or building PySpecto

Network accessline 440

pyspector scan ./my-python-project pyspector scan --url https://github.com/username/repo.git

Network accessline 441

pyspector scan --url https://github.com/username/repo.git

`SKILL.md`

Network accessline 1

--- name: pyspector-security-audit description: Run a full Python codebase security audit using PySpector (https://github.com/ParzivalHack/PySpector), a Rust-core SAST scanner. Use this skill whenever the user asks for a security audit, vul

Network accessline 2

name: pyspector-security-audit description: Run a full Python codebase security audit using PySpector (https://github.com/ParzivalHack/PySpector), a Rust-core SAST scanner. Use this skill whenever the user asks for a security audit, vulnera

Network accessline 3

description: Run a full Python codebase security audit using PySpector (https://github.com/ParzivalHack/PySpector), a Rust-core SAST scanner. Use this skill whenever the user asks for a security audit, vulnerability scan, SAST scan, code se

Network accessline 10

PySpector is a Rust-core, Python-CLI SAST tool with a flow-sensitive, inter-procedural taint engine. Its ruleset spans regex (secrets/config), AST (anti-patterns), and graph/taint (data-flow vulnerability chains), plus optional AI/LLM-speci

Dangerous shell operationline 39

cargo --version || (curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && source "$HOME/.cargo/env")

Network accessline 39

cargo --version || (curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && source "$HOME/.cargo/env")

Network accessline 42

On Windows: first check whether `rustc`/`cargo` are already available. If not, check whether a `rustup-init.exe` installer is already present on the system (e.g. in the user's Downloads folder or a known path); if it is, run it. If no insta

`benchmarks/speed/bandit.yml`

Network accessline 4

image: python   author:     - https://github.com/PyCQA

Network accessline 5

author:     - https://github.com/PyCQA   example: satori run ./bandit.yml --repo satorici/satori-cli --report --output

Network accessline 6
```
- https://github.com/PyCQA
```

`benchmarks/speed/benchmark.sh`

Executable scriptline 1
```
#!/bin/bash
```

`benchmarks/speed/benchmarkgraph.py`

Executable scriptline 1
```
#!/usr/bin/env python3
```

`benchmarks/speed/fastapi_fastapi_bandit_run5_20260828_145113.log`

Network accessline 1

Satori CI 1.99.2 - Automated Testing - Started on 2026-08-28 14:41:05 Report ID: rM3lh0ysLeNfRvzm Report: https://satori.ci/report/rM3lh0ysLeNfRvzm

Network accessline 2

Report ID: rM3lh0ysLeNfRvzm Report: https://satori.ci/report/rM3lh0ysLeNfRvzm Repository: fastapi/fastapi

Network accessline 3

Report: https://satori.ci/report/rM3lh0ysLeNfRvzm

`benchmarks/speed/pyspector.yml`

Network accessline 4

image: satori   author:     - https://github.com/ParzivalHack

Network accessline 5

author:     - https://github.com/ParzivalHack   example: satori run ./pyspector.yml --repo satorici/satori-cli --report --output

Network accessline 6
```
- https://github.com/ParzivalHack
```

`benchmarks/speed/semgrep.yml`

Network accessline 4

image: python:3.10-slim   author:     - https://github.com/semgrep

Network accessline 5

author:     - https://github.com/semgrep   example: satori run ./semgrep.yml --repo satorici/satori-cli --report --output

Network accessline 6
```
- https://github.com/semgrep
```

`index.html`

Network accessline 12

<link rel="preconnect" href="https://fonts.googleapis.com" />

Network accessline 13

<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />

Network accessline 14

<link href="https://fonts.googleapis.com/css2?family=Space+Grotesk:wght@400;500;600;700&family=JetBrains+Mono:wght@400;500;600;700&display=swap" rel="stylesheet" />

Network accessline 781

<img class="brand-logo-img" src="logo.png" alt="PySpector" />       </a>       <a class="brand-sub" href="https://www.securitycert.it/" target="_blank" rel="noopener">Powered by SecurityCert</a>

Network accessline 782

</a>       <a class="brand-sub" href="https://www.securitycert.it/" target="_blank" rel="noopener">Powered by SecurityCert</a>     </div>

Network accessline 783

<a class="brand-sub" href="https://www.securitycert.it/" target="_blank" rel="noopener">Powered by SecurityCert</a>

Network accessline 795

<div class="nav-actions">       <a class="release-pill" id="release-link" href="https://github.com/ParzivalHack/PySpector/releases" target="_blank" rel="noopener">

Network accessline 796

<a class="release-pill" id="release-link" href="https://github.com/ParzivalHack/PySpector/releases" target="_blank" rel="noopener">

Network accessline 798

</a>       <a class="btn ghost" href="mailto:pyspector@biz.securitycert.it">Talk to Sales</a>       <a class="btn primary" href="https://github.com/ParzivalHack/PySpector" target="_blank" rel="noopener">

Network accessline 799

<a class="btn ghost" href="mailto:pyspector@biz.securitycert.it">Talk to Sales</a>       <a class="btn primary" href="https://github.com/ParzivalHack/PySpector" target="_blank" rel="noopener">         <svg class="gh-ico" viewBox="0 0 16 16"

Network accessline 800

<a class="btn primary" href="https://github.com/ParzivalHack/PySpector" target="_blank" rel="noopener">

Network accessline 815

<a href="#security" onclick="toggleMobileMenu()">Security Policy</a>   <a href="#community" onclick="toggleMobileMenu()">Community</a>   <a href="https://github.com/ParzivalHack/PySpector" target="_blank" rel="noopener">GitHub ↗</a>

Network accessline 816

<a href="#community" onclick="toggleMobileMenu()">Community</a>   <a href="https://github.com/ParzivalHack/PySpector" target="_blank" rel="noopener">GitHub ↗</a>   <a href="mailto:pyspector@biz.securitycert.it">Talk to Sales</a>

Network accessline 817

<a href="https://github.com/ParzivalHack/PySpector" target="_blank" rel="noopener">GitHub ↗</a>

Network accessline 843

<div class="proof-item"><span class="proof-num"><em class="count" data-count="2.1" data-decimals="1" data-suffix="×">2.1×</em> faster</span><span class="proof-label">than Bandit</span></div>         <div class="proof-item"><span class="proo

Network accessline 844

<div class="proof-item"><span class="proof-num"><em class="count" data-count="3.7" data-decimals="1" data-suffix="×">3.7×</em> faster</span><span class="proof-label">than Semgrep</span></div>         <div class="proof-item"><a href="https:/

Network accessline 845

<div class="proof-item"><a href="https://github.com/ParzivalHack/PySpector" target="_blank" rel="noopener" class="proof-link"><span class="proof-num"><em id="star-count">145+</em></span><span class="proof-label">GitHub stars</span></a></div

Network accessline 846

<div class="proof-item"><span class="proof-num"><em class="count" data-count="3">3</em></span><span class="proof-label">analysis engines</span></div>         <div class="proof-item"><a href="https://pepy.tech/projects/pyspector" target="_bl

Network accessline 847

<div class="proof-item"><a href="https://pepy.tech/projects/pyspector" target="_blank" rel="noopener" class="proof-link"><span class="proof-num"><em class="count" data-count="50000" data-suffix="+">50,000+</em></span><span class="proof-labe

Network accessline 848

<div class="proof-item"><a href="https://github.com/ParzivalHack/PySpector/graphs/contributors?all=1" target="_blank" rel="noopener" class="proof-link"><span class="proof-num"><em class="count" data-count="20" data-suffix="+">20+</em></span

Network accessline 895

<div class="container trusted-inner">     <span class="trusted-label">Trusted by</span>     <a class="trusted-spotlight" href="https://satori.ci/" target="_blank" rel="noopener" aria-label="SatoriCI — core scan engine">

Network accessline 896

<span class="trusted-label">Trusted by</span>     <a class="trusted-spotlight" href="https://satori.ci/" target="_blank" rel="noopener" aria-label="SatoriCI — core scan engine">       <img class="trusted-spotlight-logo" src="https://satori.

Network accessline 897

<a class="trusted-spotlight" href="https://satori.ci/" target="_blank" rel="noopener" aria-label="SatoriCI — core scan engine">

Network accessline 898

<img class="trusted-spotlight-logo" src="https://satori.ci/img/logo.svg" alt="SatoriCI" loading="lazy" />

Network accessline 1008

</div>     <div style="display:flex; justify-content:center; margin: 4px 0 32px;">       <a class="btn ghost" href="https://github.com/user-attachments/files/31597398/PySpector.Performance.Benchmark.A.Comparative.Speed.and.Resource-Efficien

Network accessline 1009

<div style="display:flex; justify-content:center; margin: 4px 0 32px;">       <a class="btn ghost" href="https://github.com/user-attachments/files/31597398/PySpector.Performance.Benchmark.A.Comparative.Speed.and.Resource-Efficiency.Analysis

Network accessline 1010

<a class="btn ghost" href="https://github.com/user-attachments/files/31597398/PySpector.Performance.Benchmark.A.Comparative.Speed.and.Resource-Efficiency.Analysis.Against.Bandit.and.Semgrep.Across.Eight.Open-Source.Python.Codebases.pdf" tar

Network accessline 1033

</div>         </div>         <p class="bench-note">Dedicated cloud compute via Satori CI (16 vCPUs, 120 GB RAM). Values are the average across five runs per tool per repository. Raw benchmark data, tool configurations, and the full technic

Network accessline 1034

</div>         <p class="bench-note">Dedicated cloud compute via Satori CI (16 vCPUs, 120 GB RAM). Values are the average across five runs per tool per repository. Raw benchmark data, tool configurations, and the full technical whitepaper a

Network accessline 1035

<p class="bench-note">Dedicated cloud compute via Satori CI (16 vCPUs, 120 GB RAM). Values are the average across five runs per tool per repository. Raw benchmark data, tool configurations, and the full technical whitepaper are available in

Network accessline 1112

<tbody>               <tr><td><strong>Python</strong></td><td>3.9 to 3.14</td><td>A dedicated Python 3.14 virtual environment is highly recommended.</td></tr>               <tr><td><strong>Rust toolchain</strong></td><td>stable</td><td>Requ

Network accessline 1113

<tr><td><strong>Python</strong></td><td>3.9 to 3.14</td><td>A dedicated Python 3.14 virtual environment is highly recommended.</td></tr>               <tr><td><strong>Rust toolchain</strong></td><td>stable</td><td>Required for the analysis

Network accessline 1114

<tr><td><strong>Rust toolchain</strong></td><td>stable</td><td>Required for the analysis core. Install via <a href="https://rustup.rs/" target="_blank" rel="noopener">rustup</a>, then verify with <code>cargo --version</code>.</td></tr>

Network accessline 1166

<h4>Common invocations</h4>           <div class="codeblock">             <div class="codeblock-head"><span class="codeblock-lang">bash</span><button class="copy-btn" data-copy="pyspector scan /path/to/your/project&#10;pyspector scan /path/

Network accessline 1167

<div class="codeblock">             <div class="codeblock-head"><span class="codeblock-lang">bash</span><button class="copy-btn" data-copy="pyspector scan /path/to/your/project&#10;pyspector scan /path/to/your/project -o report.html -f html

Network accessline 1168

<div class="codeblock-head"><span class="codeblock-lang">bash</span><button class="copy-btn" data-copy="pyspector scan /path/to/your/project&#10;pyspector scan /path/to/your/project -o report.html -f html&#10;pyspector scan --url https://gi

Network accessline 1175

<span class="c"># Scan a public GitHub repository directly</span> <span class="p">$</span> pyspector <span class="f">scan</span> <span class="o">--url</span> <span class="s">https://github.com/username/repo.git</span></code></pre>

Network accessline 1176

<span class="p">$</span> pyspector <span class="f">scan</span> <span class="o">--url</span> <span class="s">https://github.com/username/repo.git</span></code></pre>

Network accessline 1313

<p>Point PySpector at any public GitHub or GitLab repository and it will clone and analyze it in one step, useful for auditing third-party packages before adoption, or for security research at scale. The URL host is validated, so only <code

Network accessline 1314

<div class="codeblock">             <div class="codeblock-head"><span class="codeblock-lang">bash</span><button class="copy-btn" data-copy="pyspector scan --url https://github.com/username/repo.git">Copy</button></div>             <pre><cod

Network accessline 1315

<div class="codeblock-head"><span class="codeblock-lang">bash</span><button class="copy-btn" data-copy="pyspector scan --url https://github.com/username/repo.git">Copy</button></div>

Network accessline 1316

<pre><code><span class="p">$</span> pyspector <span class="f">scan</span> <span class="o">--url</span> <span class="s">https://github.com/username/repo.git</span></code></pre>

Network accessline 1346

"driver": {           "name": "PySpector",           "informationUri": "https://github.com/ParzivalHack/PySpector"

Network accessline 1347

"name": "PySpector",           "informationUri": "https://github.com/ParzivalHack/PySpector"         }

Network accessline 1348

"informationUri": "https://github.com/ParzivalHack/PySpector"

Network accessline 1365

<span class="s">"driver"</span>: {         <span class="s">"name"</span>: <span class="s">"PySpector"</span>,         <span class="s">"informationUri"</span>: <span class="s">"https://github.com/ParzivalHack/PySpector"</span>

Network accessline 1366

<span class="s">"name"</span>: <span class="s">"PySpector"</span>,         <span class="s">"informationUri"</span>: <span class="s">"https://github.com/ParzivalHack/PySpector"</span>       }

Network accessline 1367

<span class="s">"informationUri"</span>: <span class="s">"https://github.com/ParzivalHack/PySpector"</span>

Dangerous shell operationline 1432
```
description = "Use of eval() detected."
```

Dangerous shell operationline 1438

<span class="o">description</span> = <span class="s">"Use of eval() detected."</span>

Network accessline 1503

<h4>Git pre-commit hook</h4>           <p>Block commits that introduce new HIGH or CRITICAL issues. This hook uses the <a href="https://pre-commit.com/" target="_blank" rel="noopener">pre-commit</a> framework to scan staged Python files bef

Network accessline 1504

<p>Block commits that introduce new HIGH or CRITICAL issues. This hook uses the <a href="https://pre-commit.com/" target="_blank" rel="noopener">pre-commit</a> framework to scan staged Python files before each commit:</p>

Network accessline 1505

<div class="codeblock">             <div class="codeblock-head"><span class="codeblock-lang">yaml · .pre-commit-config.yaml</span><button class="copy-btn" data-copy="repos:   - repo: https://github.com/ParzivalHack/PySpector

Network accessline 1506

<div class="codeblock-head"><span class="codeblock-lang">yaml · .pre-commit-config.yaml</span><button class="copy-btn" data-copy="repos:   - repo: https://github.com/ParzivalHack/PySpector     rev: v0.2.1-beta

Network accessline 1507

- repo: https://github.com/ParzivalHack/PySpector

Network accessline 1510

- id: pyspector">Copy</button></div>             <pre><code><span class="o">repos</span>:   - <span class="o">repo</span>: https://github.com/ParzivalHack/PySpector

Network accessline 1511

<pre><code><span class="o">repos</span>:   - <span class="o">repo</span>: https://github.com/ParzivalHack/PySpector     <span class="o">rev</span>: v0.2.1-beta

Network accessline 1512

- <span class="o">repo</span>: https://github.com/ParzivalHack/PySpector

Network accessline 1530

<div class="doc-kicker">Project · 01</div>           <h3>Contributing</h3>           <p>Every contribution helps make Python code safer: bug reports, feature ideas, new detection rules, documentation, and improvements to the Python or Rust

Network accessline 1532

<p>Every contribution helps make Python code safer: bug reports, feature ideas, new detection rules, documentation, and improvements to the Python or Rust core are all welcome. The full guide lives in <a href="https://github.com/ParzivalHac

Network accessline 1534

<h4>Development setup</h4>           <p>You need Python 3.9+ (3.14 recommended) and the Rust toolchain via <a href="https://rustup.rs/" target="_blank" rel="noopener">rustup</a>. Installing in editable mode compiles the Rust engine and lets

Network accessline 1535

<p>You need Python 3.9+ (3.14 recommended) and the Rust toolchain via <a href="https://rustup.rs/" target="_blank" rel="noopener">rustup</a>. Installing in editable mode compiles the Rust engine and lets you iterate without reinstalling:</p

Network accessline 1536

<div class="codeblock">             <div class="codeblock-head"><span class="codeblock-lang">bash</span><button class="copy-btn" data-copy="git clone https://github.com/YOURUSERNAME/PySpector.git cd PySpector

Network accessline 1537

<div class="codeblock-head"><span class="codeblock-lang">bash</span><button class="copy-btn" data-copy="git clone https://github.com/YOURUSERNAME/PySpector.git

Network accessline 1542

pyspector --help">Copy</button></div>             <pre><code><span class="c"># Fork PySpector, then clone your fork:</span> <span class="p">$</span> git <span class="f">clone</span> https://github.com/YOURUSERNAME/PySpector.git

Network accessline 1543

<pre><code><span class="c"># Fork PySpector, then clone your fork:</span> <span class="p">$</span> git <span class="f">clone</span> https://github.com/YOURUSERNAME/PySpector.git <span class="p">$</span> <span class="f">cd</span> PySpector

Network accessline 1544

<span class="p">$</span> git <span class="f">clone</span> https://github.com/YOURUSERNAME/PySpector.git

Network accessline 1560

<span class="p">$</span> mypy src/                                    <span class="c"># type checks</span></code></pre>           </div>           <p>Then create a feature branch, commit with a clear message (the repo uses conventional comm

Network accessline 1561

</div>           <p>Then create a feature branch, commit with a clear message (the repo uses conventional commits, e.g. <code>feat: add rule for insecure cookie settings</code>), push to your fork, and <a href="https://github.com/ParzivalHa

Network accessline 1562

<p>Then create a feature branch, commit with a clear message (the repo uses conventional commits, e.g. <code>feat: add rule for insecure cookie settings</code>), push to your fork, and <a href="https://github.com/ParzivalHack/PySpector/pull

Network accessline 1578

<details class="faq-item">             <summary>What can I scan?</summary>             <div class="faq-body">A local Python file, a local project directory, or a public Git repository URL: <code>pyspector scan ./my-python-project</code> or

Network accessline 1579

<summary>What can I scan?</summary>             <div class="faq-body">A local Python file, a local project directory, or a public Git repository URL: <code>pyspector scan ./my-python-project</code> or <code>pyspector scan --url https://gith

Network accessline 1580

<div class="faq-body">A local Python file, a local project directory, or a public Git repository URL: <code>pyspector scan ./my-python-project</code> or <code>pyspector scan --url https://github.com/username/repo.git</code>.</div>

Network accessline 1622

<details class="faq-item">             <summary>How can I contribute?</summary>             <div class="faq-body">Report bugs, suggest enhancements, add detection rules, or improve the Python/Rust core. The <a href="#doc-contributing">Contr

Network accessline 1623

<summary>How can I contribute?</summary>             <div class="faq-body">Report bugs, suggest enhancements, add detection rules, or improve the Python/Rust core. The <a href="#doc-contributing">Contributing</a> section covers the dev setu

Network accessline 1624

<div class="faq-body">Report bugs, suggest enhancements, add detection rules, or improve the Python/Rust core. The <a href="#doc-contributing">Contributing</a> section covers the dev setup and PR checklist, and the full guide lives in <a hr

Network accessline 1626

<details class="faq-item">             <summary>What license is PySpector under?</summary>             <div class="faq-body">PySpector is open source under the <a href="http://www.apache.org/licenses/LICENSE-2.0" target="_blank" rel="noopen

Network accessline 1627

<summary>What license is PySpector under?</summary>             <div class="faq-body">PySpector is open source under the <a href="http://www.apache.org/licenses/LICENSE-2.0" target="_blank" rel="noopener">Apache License 2.0</a>, <a href="ht

Network accessline 1628

<div class="faq-body">PySpector is open source under the <a href="http://www.apache.org/licenses/LICENSE-2.0" target="_blank" rel="noopener">Apache License 2.0</a>, <a href="https://github.com/ParzivalHack/PySpector/blob/main/NOTICE.md" tar

Network accessline 1647

<article class="doc-section" style="border-bottom: none; margin-bottom: 0; padding-bottom: 0;">         <h4 style="margin-top: 0;">How to report</h4>         <p>All security issues must be reported <strong>privately</strong> through <a href

Network accessline 1648

<h4 style="margin-top: 0;">How to report</h4>         <p>All security issues must be reported <strong>privately</strong> through <a href="https://github.com/ParzivalHack/PySpector/security/advisories/new" target="_blank" rel="noopener">GitH

Network accessline 1649

<p>All security issues must be reported <strong>privately</strong> through <a href="https://github.com/ParzivalHack/PySpector/security/advisories/new" target="_blank" rel="noopener">GitHub Security Advisories</a>. This keeps disclosure priv

Network accessline 1744

</div>     <div class="hof-grid">       <a class="hof-card reveal" href="https://github.com/satoridev01" target="_blank" rel="noopener">

Network accessline 1745

<div class="hof-grid">       <a class="hof-card reveal" href="https://github.com/satoridev01" target="_blank" rel="noopener">         <img class="hof-avatar" src="https://avatars.githubusercontent.com/u/89515805?v=4&s=120" alt="satoridev01

Network accessline 1746

<a class="hof-card reveal" href="https://github.com/satoridev01" target="_blank" rel="noopener">

Network accessline 1747

<img class="hof-avatar" src="https://avatars.githubusercontent.com/u/89515805?v=4&s=120" alt="satoridev01 avatar" loading="lazy" />

Network accessline 1749

<span class="hof-shield"><svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 22s8-3.5 8-10V5l-8-3-8 3v7c0 6.5 8 10 8 10Z"/></svg></sp

Network accessline 1750

</a>       <a class="hof-card reveal" href="https://github.com/Shinigami81" target="_blank" rel="noopener">         <img class="hof-avatar" src="https://avatars.githubusercontent.com/u/122274261?v=4&s=120" alt="Shinigami avatar" loading="la

Network accessline 1751

<a class="hof-card reveal" href="https://github.com/Shinigami81" target="_blank" rel="noopener">

Network accessline 1752

<img class="hof-avatar" src="https://avatars.githubusercontent.com/u/122274261?v=4&s=120" alt="Shinigami avatar" loading="lazy" />

Network accessline 1754

<span class="hof-shield"><svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 22s8-3.5 8-10V5l-8-3-8 3v7c0 6.5 8 10 8 10Z"/></svg></sp

Network accessline 1755

</a>       <a class="hof-card reveal" href="https://github.com/fg0x0" target="_blank" rel="noopener">         <img class="hof-avatar" src="https://avatars.githubusercontent.com/u/35772301?v=4&s=120" alt="fg0x0 avatar" loading="lazy" />

Network accessline 1756

<a class="hof-card reveal" href="https://github.com/fg0x0" target="_blank" rel="noopener">

Network accessline 1757

<img class="hof-avatar" src="https://avatars.githubusercontent.com/u/35772301?v=4&s=120" alt="fg0x0 avatar" loading="lazy" />

Network accessline 1771

</button>         </span>         <a class="btn primary" href="https://github.com/ParzivalHack/PySpector" target="_blank" rel="noopener">View on GitHub</a>

Network accessline 1772

</span>         <a class="btn primary" href="https://github.com/ParzivalHack/PySpector" target="_blank" rel="noopener">View on GitHub</a>       </div>

Network accessline 1773

<a class="btn primary" href="https://github.com/ParzivalHack/PySpector" target="_blank" rel="noopener">View on GitHub</a>

Network accessline 1786

<img class="brand-logo-img" src="logo.png" alt="PySpector" />           </a>           <a class="brand-sub" href="https://www.securitycert.it/" target="_blank" rel="noopener">Powered by SecurityCert</a>

Network accessline 1787

</a>           <a class="brand-sub" href="https://www.securitycert.it/" target="_blank" rel="noopener">Powered by SecurityCert</a>         </div>

Network accessline 1788

<a class="brand-sub" href="https://www.securitycert.it/" target="_blank" rel="noopener">Powered by SecurityCert</a>

Network accessline 1793

<h6>Project</h6>         <ul>           <li><a href="https://github.com/ParzivalHack/PySpector" target="_blank" rel="noopener">Repository</a></li>

Network accessline 1794

<ul>           <li><a href="https://github.com/ParzivalHack/PySpector" target="_blank" rel="noopener">Repository</a></li>           <li><a href="https://github.com/ParzivalHack/PySpector/releases" target="_blank" rel="noopener">Releases</a>

Network accessline 1795

<li><a href="https://github.com/ParzivalHack/PySpector" target="_blank" rel="noopener">Repository</a></li>

Network accessline 1796

<li><a href="https://github.com/ParzivalHack/PySpector/releases" target="_blank" rel="noopener">Releases</a></li>

Network accessline 1797

<li><a href="https://pypi.org/project/pyspector/" target="_blank" rel="noopener">PyPI package</a></li>

Network accessline 1798

<li><a href="https://github.com/ParzivalHack/PySpector/issues" target="_blank" rel="noopener">Issues</a></li>

Network accessline 1811

<h6>Security & community</h6>         <ul>           <li><a href="https://github.com/ParzivalHack/PySpector/security/advisories/new" target="_blank" rel="noopener">Report a vulnerability</a></li>

Network accessline 1812

<ul>           <li><a href="https://github.com/ParzivalHack/PySpector/security/advisories/new" target="_blank" rel="noopener">Report a vulnerability</a></li>           <li><a href="#security">Disclosure policy</a></li>

Network accessline 1813

<li><a href="https://github.com/ParzivalHack/PySpector/security/advisories/new" target="_blank" rel="noopener">Report a vulnerability</a></li>

Network accessline 1814

<li><a href="#security">Disclosure policy</a></li>           <li><a href="#community">Hall of Fame</a></li>           <li><a href="https://github.com/ParzivalHack/PySpector/blob/main/CONTRIBUTING.md" target="_blank" rel="noopener">Contribut

Network accessline 1815

<li><a href="#community">Hall of Fame</a></li>           <li><a href="https://github.com/ParzivalHack/PySpector/blob/main/CONTRIBUTING.md" target="_blank" rel="noopener">Contributing</a></li>         </ul>

Network accessline 1816

<li><a href="https://github.com/ParzivalHack/PySpector/blob/main/CONTRIBUTING.md" target="_blank" rel="noopener">Contributing</a></li>

Network accessline 1820

<h6>Contacts & Community</h6>         <ul>           <li><a href="https://linkedin.com/showcase/pyspector/" target="_blank" rel="noopener">LinkedIn</a></li>

Network accessline 1821

<ul>           <li><a href="https://linkedin.com/showcase/pyspector/" target="_blank" rel="noopener">LinkedIn</a></li>           <li><a href="https://discord.gg/dPq2N34hts" target="_blank" rel="noopener">Discord</a></li>

Network accessline 1822

<li><a href="https://linkedin.com/showcase/pyspector/" target="_blank" rel="noopener">LinkedIn</a></li>

Network accessline 1823

<li><a href="https://discord.gg/dPq2N34hts" target="_blank" rel="noopener">Discord</a></li>

Network accessline 1881

async function fetchLatestRelease() {   try {     const res = await fetch('https://api.github.com/repos/ParzivalHack/PySpector/releases');

Network accessline 1882

try {     const res = await fetch('https://api.github.com/repos/ParzivalHack/PySpector/releases');     if (!res.ok) return;

Network accessline 1883

const res = await fetch('https://api.github.com/repos/ParzivalHack/PySpector/releases');

Network accessline 1896

async function fetchGithubStars() {   try {     const res = await fetch('https://api.github.com/repos/ParzivalHack/PySpector');

Network accessline 1897

try {     const res = await fetch('https://api.github.com/repos/ParzivalHack/PySpector');     if (!res.ok) return;

Network accessline 1898

const res = await fetch('https://api.github.com/repos/ParzivalHack/PySpector');

`scripts/setup_cron.sh`

Executable scriptline 1
```
#!/bin/bash
```
Dangerous shell operationline 34
```
sudo mkdir -p "$REPORT_PATH"
```
Dangerous shell operationline 35
```
sudo chown "$(whoami)" "$REPORT_PATH"
```

`setup.py`

Executable scriptline 1
```
Executable file
```

`src/pyspector/init.py`

Executable scriptline 1
```
Executable file
```

`src/pyspector/_ast_encode.py`

Executable scriptline 1
```
Executable file
```

`src/pyspector/_parallel.py`

Executable scriptline 1
```
Executable file
```
Access to secretsline 39
```
[Credential-related source omitted]
```

`src/pyspector/_rust_core/src/analysis/mod.rs`

Dangerous shell operationline 123

// stay distinct so `os.system(eval(x))` reports both CWE-78 and CWE-94.

`src/pyspector/_rust_core/src/analysis/taint_analysis.rs`

Access to secretsline 37
```
[Credential-related source omitted]
```
Access to secretsline 182
```
[Credential-related source omitted]
```
Access to secretsline 746
```
[Credential-related source omitted]
```
Access to secretsline 749
```
[Credential-related source omitted]
```
Access to secretsline 863
```
[Credential-related source omitted]
```
Access to secretsline 902
```
[Credential-related source omitted]
```
Access to secretsline 906
```
[Credential-related source omitted]
```

Network accessline 959

for sink in &ruleset.taint_sinks {                                         let matches = if sink.function_call.contains('.') {                                             // Forward-only: "urllib.request.urlopen".contains("open") would be a

Network accessline 960

let matches = if sink.function_call.contains('.') {                                             // Forward-only: "urllib.request.urlopen".contains("open") would be a FP                                             call_name.contains(&sink.fu

Network accessline 961

// Forward-only: "urllib.request.urlopen".contains("open") would be a FP

Network accessline 1390

//     call_name must equal funcname exactly (prevents "cache.set" matching "set")         let matches = if sink.function_call.contains('.') {             // Forward-only: "urllib.request.urlopen".contains("open") is a FP

Network accessline 1391

let matches = if sink.function_call.contains('.') {             // Forward-only: "urllib.request.urlopen".contains("open") is a FP             call_name.contains(&sink.function_call)

Network accessline 1392

// Forward-only: "urllib.request.urlopen".contains("open") is a FP

Network accessline 1470

}                     // Also check if the arg contains an inline taint source call                     // e.g. httpx.stream("GET", r.json()["url"]) — r.json() is a source

Network accessline 1471

// Also check if the arg contains an inline taint source call                     // e.g. httpx.stream("GET", r.json()["url"]) — r.json() is a source                     if !found_taint {

Network accessline 1472

// e.g. httpx.stream("GET", r.json()["url"]) — r.json() is a source

`src/pyspector/_rust_core/src/supply_chain.rs`

Network accessline 458

fn raw_query_osv(client: &reqwest::blocking::Client, name: &str, version: &str, ecosystem: &str) -> Vec<OsvVulnerability> {     let url = "https://api.osv.dev/v1/query";

Network accessline 459

let url = "https://api.osv.dev/v1/query";

`src/pyspector/ast_cache.py`

Executable scriptline 1
```
Executable file
```

Possible obfuscationline 226

full_ast_json_z=base64.b64decode(d["full_ast_json_z"]),

Possible obfuscationline 233

ast_json_z=base64.b64decode(v["ast_json_z"]),

`src/pyspector/cli.py`

Executable scriptline 1
```
Executable file
```

Network accessline 43

]     try:         url = "https://v2.jokeapi.dev/joke/Programming?safe-mode&type=single"

Network accessline 44

try:         url = "https://v2.jokeapi.dev/joke/Programming?safe-mode&type=single"         response = requests.get(url, timeout=1.5)

Network accessline 45

url = "https://v2.jokeapi.dev/joke/Programming?safe-mode&type=single"         response = requests.get(url, timeout=1.5)         if response.status_code == 200:

Network accessline 46

response = requests.get(url, timeout=1.5)

`src/pyspector/config.py`

Executable scriptline 1
```
Executable file
```

`src/pyspector/messages.py`

Executable scriptline 1
```
Executable file
```

`src/pyspector/reporting.py`

Executable scriptline 1
```
Executable file
```

Network accessline 198

name="PySpector",             version=_PYSPECTOR_VERSION,             information_uri="https://github.com/your-org/pyspector",

Network accessline 199

version=_PYSPECTOR_VERSION,             information_uri="https://github.com/your-org/pyspector",             rules=rules,

Network accessline 200

information_uri="https://github.com/your-org/pyspector",

Network accessline 246

version="2.1.0",             schema_uri=(                 "https://raw.githubusercontent.com/oasis-tcs/"

Network accessline 247

schema_uri=(                 "https://raw.githubusercontent.com/oasis-tcs/"                 "sarif-spec/master/Schemata/sarif-schema-2.1.0.json"

Network accessline 248

"https://raw.githubusercontent.com/oasis-tcs/"

`src/pyspector/rules/init.py`

Executable scriptline 1
```
Executable file
```

`src/pyspector/rules/built-in-rules-ai.toml`

Dangerous shell operationline 193

remediation = "The `LLMMathChain` uses `eval()` internally. Avoid using it with any user-controllable input."

Access to secretsline 504
```
[Credential-related source omitted]
```
Access to secretsline 513
```
[Credential-related source omitted]
```
Access to secretsline 522
```
[Credential-related source omitted]
```
Access to secretsline 531
```
[Credential-related source omitted]
```

Dangerous shell operationline 561

description = "LLM output is passed directly to exec() or eval(), risking arbitrary code execution."

`src/pyspector/rules/built-in-rules.toml`

Access to secretsline 100
```
[Credential-related source omitted]
```

Network accessline 749

id = "SK_SSRF001" vulnerability_id = "SSRF_001" description = "User-controlled URL in httpx.stream() — SSRF: attacker can redirect to internal services or file:// URIs."

Network accessline 750

vulnerability_id = "SSRF_001" description = "User-controlled URL in httpx.stream() — SSRF: attacker can redirect to internal services or file:// URIs." function_call = "httpx.stream"

Network accessline 751

description = "User-controlled URL in httpx.stream() — SSRF: attacker can redirect to internal services or file:// URIs."

Network accessline 757

id = "SK_SSRF002" vulnerability_id = "SSRF_001" description = "User-controlled URL in httpx.get() — SSRF risk."

Network accessline 758

vulnerability_id = "SSRF_001" description = "User-controlled URL in httpx.get() — SSRF risk." function_call = "httpx.get"

Network accessline 759

description = "User-controlled URL in httpx.get() — SSRF risk."

Network accessline 765

id = "SK_SSRF003" vulnerability_id = "SSRF_001" description = "User-controlled URL in httpx.post() — SSRF risk."

Network accessline 766

vulnerability_id = "SSRF_001" description = "User-controlled URL in httpx.post() — SSRF risk." function_call = "httpx.post"

Network accessline 767

description = "User-controlled URL in httpx.post() — SSRF risk."

Network accessline 773

id = "SK_SSRF004" vulnerability_id = "SSRF_001" description = "User-controlled URL in httpx.request() — SSRF risk."

Network accessline 774

vulnerability_id = "SSRF_001" description = "User-controlled URL in httpx.request() — SSRF risk." function_call = "httpx.request"

Network accessline 775

description = "User-controlled URL in httpx.request() — SSRF risk."

Network accessline 781

id = "SK_SSRF005" vulnerability_id = "SSRF_001" description = "User-controlled URL in requests.get() — SSRF risk."

Network accessline 782

vulnerability_id = "SSRF_001" description = "User-controlled URL in requests.get() — SSRF risk." function_call = "requests.get"

Network accessline 783

description = "User-controlled URL in requests.get() — SSRF risk."

Network accessline 789

id = "SK_SSRF006" vulnerability_id = "SSRF_001" description = "User-controlled URL in requests.post() — SSRF risk."

Network accessline 790

vulnerability_id = "SSRF_001" description = "User-controlled URL in requests.post() — SSRF risk." function_call = "requests.post"

Network accessline 791

description = "User-controlled URL in requests.post() — SSRF risk."

Network accessline 797

id = "SK_SSRF007" vulnerability_id = "SSRF_001" description = "User-controlled URL in requests.request() — SSRF risk."

Network accessline 798

vulnerability_id = "SSRF_001" description = "User-controlled URL in requests.request() — SSRF risk." function_call = "requests.request"

Network accessline 799

description = "User-controlled URL in requests.request() — SSRF risk."

Network accessline 805

id = "SK_SSRF008" vulnerability_id = "SSRF_001" description = "User-controlled URL in urllib.request.urlopen() — SSRF risk."

Network accessline 806

vulnerability_id = "SSRF_001" description = "User-controlled URL in urllib.request.urlopen() — SSRF risk." function_call = "urllib.request.urlopen"

Network accessline 807

description = "User-controlled URL in urllib.request.urlopen() — SSRF risk."

Network accessline 808

function_call = "urllib.request.urlopen"

Dangerous shell operationline 1066

description = "Use of exec() enables arbitrary code execution"

Access to secretsline 1148
```
[Credential-related source omitted]
```
Access to secretsline 1153
```
[Credential-related source omitted]
```
Access to secretsline 1156
```
[Credential-related source omitted]
```
Access to secretsline 1164
```
[Credential-related source omitted]
```
Access to secretsline 1170
```
[Credential-related source omitted]
```
Network accessline 1266
```
[Credential-related source omitted]
```
Network accessline 1267
```
[Credential-related source omitted]
```
Network accessline 1268
```
[Credential-related source omitted]
```
Network accessline 1301
```
[Credential-related source omitted]
```
Network accessline 1302
```
[Credential-related source omitted]
```
Network accessline 1303
```
[Credential-related source omitted]
```
Network accessline 1333
```
[Credential-related source omitted]
```
Network accessline 1334
```
[Credential-related source omitted]
```
Network accessline 1335
```
[Credential-related source omitted]
```
Access to secretsline 1335
```
[Credential-related source omitted]
```
Network accessline 1345
```
[Credential-related source omitted]
```
Network accessline 1346
```
[Credential-related source omitted]
```
Network accessline 1347
```
[Credential-related source omitted]
```
Access to secretsline 1347
```
[Credential-related source omitted]
```
Network accessline 1361
```
[Credential-related source omitted]
```
Network accessline 1362
```
[Credential-related source omitted]
```
Network accessline 1363
```
[Credential-related source omitted]
```
Network accessline 1428
```
[Credential-related source omitted]
```
Network accessline 1429
```
[Credential-related source omitted]
```
Network accessline 1430
```
[Credential-related source omitted]
```
Network accessline 1434
```
[Credential-related source omitted]
```
Network accessline 1435
```
[Credential-related source omitted]
```
Network accessline 1436
```
[Credential-related source omitted]
```
Network accessline 1441
```
[Credential-related source omitted]
```
Network accessline 1442
```
[Credential-related source omitted]
```
Network accessline 1443
```
[Credential-related source omitted]
```
Network accessline 1450
```
[Credential-related source omitted]
```
Network accessline 1451
```
[Credential-related source omitted]
```
Network accessline 1452
```
[Credential-related source omitted]
```
Network accessline 1460
```
[Credential-related source omitted]
```
Network accessline 1461
```
[Credential-related source omitted]
```
Network accessline 1462
```
[Credential-related source omitted]
```
Network accessline 1470
```
[Credential-related source omitted]
```
Network accessline 1471
```
[Credential-related source omitted]
```
Network accessline 1472
```
[Credential-related source omitted]
```
Network accessline 1496
```
[Credential-related source omitted]
```
Network accessline 1497
```
[Credential-related source omitted]
```
Network accessline 1498
```
[Credential-related source omitted]
```
Network accessline 1511
```
[Credential-related source omitted]
```
Network accessline 1512
```
[Credential-related source omitted]
```
Network accessline 1513
```
[Credential-related source omitted]
```
Network accessline 1544
```
[Credential-related source omitted]
```
Network accessline 1545
```
[Credential-related source omitted]
```
Network accessline 1546
```
[Credential-related source omitted]
```
Network accessline 1557
```
[Credential-related source omitted]
```
Network accessline 1558
```
[Credential-related source omitted]
```
Network accessline 1559
```
[Credential-related source omitted]
```
Network accessline 1571
```
[Credential-related source omitted]
```
Network accessline 1572
```
[Credential-related source omitted]
```
Network accessline 1573
```
[Credential-related source omitted]
```
Access to secretsline 1590
```
[Credential-related source omitted]
```
Dangerous shell operationline 1669
```
[Credential-related source omitted]
```
Dangerous shell operationline 1672
```
[Credential-related source omitted]
```
Access to secretsline 2015
```
[Credential-related source omitted]
```
Network accessline 2225
```
[Credential-related source omitted]
```
Network accessline 2226
```
[Credential-related source omitted]
```
Network accessline 2227
```
[Credential-related source omitted]
```
Network accessline 2228
```
[Credential-related source omitted]
```
Access to secretsline 2572
```
[Credential-related source omitted]
```
Access to secretsline 2614
```
[Credential-related source omitted]
```
Access to secretsline 2620
```
[Credential-related source omitted]
```
Access to secretsline 2626
```
[Credential-related source omitted]
```

`src/pyspector/stats.py`

Executable scriptline 1
```
Executable file
```

`src/pyspector/triage.py`

Executable scriptline 1
```
Executable file
```

`tests/examples/hardcoded_anthropic_key.py`

Executable scriptline 1
```
[Credential-related source omitted]
```
Access to secretsline 1
```
[Credential-related source omitted]
```

`tests/unit/ast_cache_test.py`

Executable scriptline 1
```
Executable file
```

`tests/unit/reporting_test.py`

Executable scriptline 1
```
Executable file
```

Network accessline 83

self.assertEqual(             output_json.get("$schema"),             "https://raw.githubusercontent.com/oasis-tcs/"

Network accessline 84

output_json.get("$schema"),             "https://raw.githubusercontent.com/oasis-tcs/"             "sarif-spec/master/Schemata/sarif-schema-2.1.0.json",

Network accessline 85

"https://raw.githubusercontent.com/oasis-tcs/"

`tests/unit/test_a_sink_rules.py`

Executable scriptline 1
```
Executable file
```

`tests/unit/test_ai_rules.py`

Executable scriptline 1
```
Executable file
```

Network accessline 222

code = """             url = input("target: ")             requests.get(url)

Network accessline 223

url = input("target: ")             requests.get(url)         """

Network accessline 224
```
requests.get(url)
```

Network accessline 230

def test_ai601_removed_trusted_url_not_tainted(self):         code = """             response = requests.get("https://api.example.com/data")

Network accessline 231

code = """             response = requests.get("https://api.example.com/data")         """

Network accessline 232

response = requests.get("https://api.example.com/data")

Network accessline 237

code = """             url = input("target: ")             requests.get(

Network accessline 238

url = input("target: ")             requests.get(                 url,

Network accessline 239
```
requests.get(
```

Network accessline 247

code = """             url = request.form.get("url")             requests.get(url)

Network accessline 248

url = request.form.get("url")             requests.get(url)         """

Network accessline 249
```
requests.get(url)
```
Access to secretsline 393
```
[Credential-related source omitted]
```
Access to secretsline 397
```
[Credential-related source omitted]
```
Access to secretsline 406
```
[Credential-related source omitted]
```
Access to secretsline 420
```
[Credential-related source omitted]
```

Dangerous shell operationline 469

assert re.search(rule["pattern"], "result = eval(llm_output)")

Dangerous shell operationline 473
```
result = eval(expr)
```

`tests/unit/test_config.py`

Executable scriptline 1
```
Executable file
```

`tests/unit/test_false_positive_reductions.py`

Executable scriptline 1
```
Executable file
```

Dangerous shell operationline 168

assert triggered,              f"At least one danger rule should fire for exec(compile(user_code)), got: {findings}"

Dangerous shell operationline 169

f"At least one danger rule should fire for exec(compile(user_code)), got: {findings}"

Access to secretsline 235
```
[Credential-related source omitted]
```
Access to secretsline 241
```
[Credential-related source omitted]
```

Possible obfuscationline 360

value = pickle.loads(base64.b64decode(data))

`tests/unit/test_frontend_parallel.py`

Executable scriptline 1
```
Executable file
```
Access to secretsline 94
```
[Credential-related source omitted]
```
Access to secretsline 101
```
[Credential-related source omitted]
```
Access to secretsline 107
```
[Credential-related source omitted]
```
Access to secretsline 110
```
[Credential-related source omitted]
```
Access to secretsline 111
```
[Credential-related source omitted]
```

`tests/unit/test_get_asts.py`

Executable scriptline 1
```
Executable file
```

Possible obfuscationline 31

self.encoding_err.write_bytes(b"\xff\xfe\x00\x00")

`tests/unit/test_group_a_rules.py`

Executable scriptline 1
```
Executable file
```

`tests/unit/test_missing_rules.py`

Executable scriptline 1
```
Executable file
```

Network accessline 167

class TestTLS001:     def test_verify_false_fires(self):         code = "resp = requests.get(url, verify=False)"

Network accessline 169

code = "resp = requests.get(url, verify=False)"

Network accessline 178

def test_verify_true_safe(self):         code = "resp = requests.get(url, verify=True)"

Network accessline 179

code = "resp = requests.get(url, verify=True)"

Network accessline 182

def test_verify_capath_safe(self):         code = "resp = requests.get(url, verify='/etc/ssl/certs/ca-bundle.crt')"

Network accessline 183

code = "resp = requests.get(url, verify='/etc/ssl/certs/ca-bundle.crt')"

Access to secretsline 359
```
[Credential-related source omitted]
```

`tests/unit/test_semantic_provenance.py`

Executable scriptline 1
```
Executable file
```

`tests/unit/test_symlink_containment.py`

Executable scriptline 1
```
Executable file
```

`tests/unit/test_taint_engine_extension.py`

Executable scriptline 1
```
Executable file
```
Access to secretsline 231
```
[Credential-related source omitted]
```
Access to secretsline 246
```
[Credential-related source omitted]
```
Access to secretsline 250
```
[Credential-related source omitted]
```
Access to secretsline 254
```
[Credential-related source omitted]
```
Access to secretsline 255
```
[Credential-related source omitted]
```

How the signals fit together

Facts from a static read of the files at the pinned commit. They describe what the code does, not why.

Some files could not be read; the facts below still hold.

Declared and executed: 1 fact

Contacts v2.jokeapi.dev, which SKILL.md, the README and the plugin manifest do not mentionsrc/pyspector/cli.py:45High confidence

Signal confidence: 175 facts

Network access in prose of documentation.github/SECURITY.md:8Low confidence
Network access in prose of documentation.github/SECURITY.md:9Low confidence
Network access in prose of documentationCODE_OF_CONDUCT.md:117Low confidence
Network access in prose of documentationCODE_OF_CONDUCT.md:119Low confidence
Network access in prose of documentationCODE_OF_CONDUCT.md:121Low confidence
Network access in prose of documentationCODE_OF_CONDUCT.md:122Low confidence
Network access in prose of documentationCODE_OF_CONDUCT.md:124Low confidence
Network access in prose of documentationCODE_OF_CONDUCT.md:126Low confidence
Network access in prose of documentationCODE_OF_CONDUCT.md:127Low confidence
Network access in prose of documentationCODE_OF_CONDUCT.md:128Low confidence
Network access in prose of documentationCONTRIBUTING.md:1Low confidence
Network access in prose of documentationCONTRIBUTING.md:2Low confidence
Network access in prose of documentationCONTRIBUTING.md:17Low confidence
Network access in prose of documentationCONTRIBUTING.md:18Low confidence
Network access in prose of documentationCONTRIBUTING.md:20Low confidence
Network access in prose of documentationCONTRIBUTING.md:30Low confidence
Network access in prose of documentationCONTRIBUTING.md:31Low confidence
Network access in prose of documentationCONTRIBUTING.md:35Low confidence
Network access in prose of documentationCONTRIBUTING.md:36Low confidence
Network access in prose of documentationCONTRIBUTING.md:37Low confidence
Dangerous shell operation in code of documentationCONTRIBUTING.md:160Low confidence
Network access in prose of documentationCONTRIBUTING.md:179Low confidence
Network access in prose of documentationCONTRIBUTING.md:181Low confidence
Executable script in code of a file that runsDockerfile:1High confidence
Network access in code of a file that runsDockerfile:3High confidence
Network access in code of a file that runsDockerfile:4High confidence
Dangerous shell operation in code of a file that runsDockerfile:6High confidence
Network access in code of a file that runsDockerfile:6High confidence
Dangerous shell operation in code of a file that runsDockerfile:22High confidence
Network access in code of a file that runsDockerfile:22High confidence
Network access in code of a file that runsDockerfile:23High confidence
Network access in code of a file that runsDockerfile:24High confidence
Dangerous shell operation in code of a file that runsDockerfile:28High confidence
Dangerous shell operation in code of a file that runsDockerfile:31High confidence
Network access in code of a file that runsDockerfile:31High confidence
Network access in prose of documentationNOTICE.md:7Low confidence
Network access in prose of documentationNOTICE.md:8Low confidence
Network access in prose of documentationREADME.md:1Low confidence
Network access in prose of documentationREADME.md:5Low confidence
Network access in prose of documentationREADME.md:6Low confidence
Network access in prose of documentationREADME.md:7Low confidence
Network access in prose of documentationREADME.md:8Low confidence
Network access in prose of documentationREADME.md:9Low confidence
Network access in prose of documentationREADME.md:10Low confidence
Network access in prose of documentationREADME.md:11Low confidence
Network access in prose of documentationREADME.md:12Low confidence
Network access in prose of documentationREADME.md:13Low confidence
Network access in prose of documentationREADME.md:14Low confidence
Network access in prose of documentationREADME.md:15Low confidence
Network access in prose of documentationREADME.md:42Low confidence

and 125 more

Works with

Agent compatibility, from the files in this repository
Agent	Status	Evidence	Install to
Claude Code	Compatible	Standard SKILL.md SKILL.md	`.claude/skills/<skill-name>/`
Codex	Compatible	Standard SKILL.md SKILL.md	`.agents/skills/<skill-name>/`
Cursor	Compatible	Standard SKILL.md SKILL.md	`.cursor/skills/<skill-name>/`
Gemini CLI	Compatible	Standard SKILL.md SKILL.md	`.gemini/skills/<skill-name>/`
GitHub Copilot	Compatible	Standard SKILL.md SKILL.md	`.github/skills/<skill-name>/`
OpenCode	Compatible	Standard SKILL.md SKILL.md	`.opencode/skills/<skill-name>/`

Native The repository ships a manifest, folder or frontmatter field for this agent.
Compatible A standard SKILL.md that this agent can read.
Unknown No evidence either way.

Derived automatically from paths, manifests and frontmatter. Not tested on each agent.

ParzivalHack/PySpector

History

SKILL.md

Share this page

Heat

Stars over time

Individual skills in this repository

How it works

pyspector-security-audit

Frontmatter

SKILL.md

Reference documents

The playbook

Scripts executed separately

Files

Skills included

Repository facts

Before you install

.dockerignore

.github/SECURITY.md

.gitignore

.pre-commit-config.yaml

.satori.yml

CODE_OF_CONDUCT.md

CONTRIBUTING.md

Dockerfile

LICENSE

NOTICE.md

README.md

SKILL.md

benchmarks/speed/bandit.yml

benchmarks/speed/benchmark.sh

benchmarks/speed/benchmarkgraph.py

benchmarks/speed/fastapi_fastapi_bandit_run5_20260828_145113.log

benchmarks/speed/pyspector.yml

benchmarks/speed/semgrep.yml

index.html

scripts/setup_cron.sh

setup.py

src/pyspector/__init__.py

src/pyspector/_ast_encode.py

src/pyspector/_parallel.py

src/pyspector/_rust_core/src/analysis/mod.rs

src/pyspector/_rust_core/src/analysis/taint_analysis.rs

src/pyspector/_rust_core/src/supply_chain.rs

src/pyspector/ast_cache.py

src/pyspector/cli.py

src/pyspector/config.py

src/pyspector/messages.py

src/pyspector/reporting.py

src/pyspector/rules/__init__.py

src/pyspector/rules/built-in-rules-ai.toml

src/pyspector/rules/built-in-rules.toml

src/pyspector/stats.py

src/pyspector/triage.py

tests/examples/hardcoded_anthropic_key.py

tests/unit/ast_cache_test.py

tests/unit/reporting_test.py

tests/unit/test_a_sink_rules.py

tests/unit/test_ai_rules.py

tests/unit/test_config.py

tests/unit/test_false_positive_reductions.py

tests/unit/test_frontend_parallel.py

tests/unit/test_get_asts.py

tests/unit/test_group_a_rules.py

tests/unit/test_missing_rules.py

tests/unit/test_semantic_provenance.py

tests/unit/test_symlink_containment.py

tests/unit/test_taint_engine_extension.py

How the signals fit together

Works with

You might also use

AgentSecOps/SecOpsAgentKit

nealbridges/VulnHunter

fortify/skills

utkusen/sast-skills

Zyrexnn/Cybermes

Orizon-eu/claude-code-pentest

`SKILL.md`

`.dockerignore`

`.github/SECURITY.md`

`.gitignore`

`.pre-commit-config.yaml`

`.satori.yml`

`CODE_OF_CONDUCT.md`

`CONTRIBUTING.md`

`Dockerfile`

`LICENSE`

`NOTICE.md`

`README.md`

`SKILL.md`

`benchmarks/speed/bandit.yml`

`benchmarks/speed/benchmark.sh`

`benchmarks/speed/benchmarkgraph.py`

`benchmarks/speed/fastapi_fastapi_bandit_run5_20260828_145113.log`

`benchmarks/speed/pyspector.yml`

`benchmarks/speed/semgrep.yml`

`index.html`

`scripts/setup_cron.sh`

`setup.py`

`src/pyspector/init.py`

`src/pyspector/_ast_encode.py`

`src/pyspector/_parallel.py`

`src/pyspector/_rust_core/src/analysis/mod.rs`

`src/pyspector/_rust_core/src/analysis/taint_analysis.rs`

`src/pyspector/_rust_core/src/supply_chain.rs`

`src/pyspector/ast_cache.py`

`src/pyspector/cli.py`

`src/pyspector/config.py`

`src/pyspector/messages.py`

`src/pyspector/reporting.py`

`src/pyspector/rules/init.py`

`src/pyspector/rules/built-in-rules-ai.toml`

`src/pyspector/rules/built-in-rules.toml`

`src/pyspector/stats.py`

`src/pyspector/triage.py`

`tests/examples/hardcoded_anthropic_key.py`

`tests/unit/ast_cache_test.py`

`tests/unit/reporting_test.py`

`tests/unit/test_a_sink_rules.py`

`tests/unit/test_ai_rules.py`

`tests/unit/test_config.py`

`tests/unit/test_false_positive_reductions.py`

`tests/unit/test_frontend_parallel.py`

`tests/unit/test_get_asts.py`

`tests/unit/test_group_a_rules.py`

`tests/unit/test_missing_rules.py`

`tests/unit/test_semantic_provenance.py`

`tests/unit/test_symlink_containment.py`

`tests/unit/test_taint_engine_extension.py`