This source did not publish a separate summary. Review SKILL.md before using the skill.
SKILL.md
Auditing Python Dependencies
Overview
PyPI hosts north of 500,000 packages, with several thousand new
releases every day. The package-install model is identical to npm in
the relevant ways: a pip install resolves a transitive graph,
runs each package's setup.py (which executes arbitrary Python at
install time), and writes the result to your site-packages. The CVE
attack surface is therefore the same shape: known vulnerabilities,
maintainer-account takeovers, typosquats, and protestware.
The PyPA-blessed auditor is pip-audit. It queries the Open Source
Vulnerabilities (OSV) database (which mirrors PyPA's advisory feed
plus aggregated CVE / GHSA records) and reports per-package
vulnerable versions. pip-audit integrates with requirements.txt,
pyproject.toml, Pipfile.lock, and poetry.lock, so most Python
project layouts are first-class.
This skill wraps pip-audit, normalizes its severity vocabulary to
the shared Severity enum, and emits Findings in the canonical
penetration-tester schema. If pip-audit isn't installed on the
host, the skill falls back to pip list --outdated and emits
INFO-level findings recommending the operator install pip-audit
for accurate vulnerability detection.
When the skill produces findings
Finding
Severity
Threshold
Affected control
Critical CVE in installed package
CRITICAL
OSV severity band corresponds to CVSS ≥ 9.0
CWE-1104
High CVE in installed package
HIGH
OSV severity band corresponds to CVSS 7.0–8.9
CWE-1104
Medium CVE in installed package
MEDIUM
OSV severity band corresponds to CVSS 4.0–6.9
CWE-1104
Low CVE in installed package
LOW
OSV severity band corresponds to CVSS 0.1–3.9
CWE-1104
Vulnerable package with no patch
HIGH
finding has no fix_versions and severity ≥ medium
CWE-1395
Outdated package (no CVE)
INFO
pip list --outdated reports a newer version
(operational)
pip-audit not installed
INFO
binary not on PATH; scanner fell back to pip list
(operational)
Audit DB unreachable
INFO
pip-audit network error reaching OSV
(operational)
OSV is the upstream of record. pip-audit also consults the PyPA
advisory database for Python-specific records that may not yet have
a CVE assigned.
Prerequisites
Python 3.9+
pip-audit installed (pip install pip-audit); skill falls back
to pip list --outdated if absent
Target project containing at minimum one of: requirements.txt,
pyproject.toml, Pipfile.lock, poetry.lock
Network access to OSV (api.osv.dev) and PyPI (pypi.org)
Instructions
Step 1 — Identify the scan target
Locate the project directory. The scanner auto-detects requirement
files in order of preference:
Run the test suite. CVE fixes occasionally include behavioral
changes you didn't expect.
Commit the lock file diff alongside the requirements bump.
For a vulnerable transitive dep (one you didn't declare directly):
Find the parent: pip show <vulnerable-package> lists the parents
in its "Required-by" line.
Check whether bumping the parent picks up the fix. pip index versions <parent> lists available versions.
If parent doesn't have a newer release that floors the vulnerable
dep above the fix version, pin the transitive dep yourself in
your requirements file. pip will use the more specific pin.
For a vulnerable package with NO fix available:
Subscribe to PyPA advisory notifications for that package.
If the vulnerability is exploitable in your usage, either
replace the package or vendor + patch locally.
Document the exception in your security register with a
re-evaluation date.
