Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIDeepSeekDeepSeekMuseMuse+22 more

    Python BugPattern — Static AST Vulnerability Auditor

    1

    Detects swallowed exceptions, bare excepts, mutable defaults, and dangerous asserts in production.

    $19.99

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned
    Python BugPattern — Static AST Vulnerability Auditor

    Python BugPattern — Static AST Vulnerability Auditor

    Example session with this skill installed

    target testing infrastructure logs and parameters

    File 1: live/scan1.py

    """Live run 1: swallowed exception, bare except, mutable default argument."""

    import os

def load_config(paths=[]):
    try:
        with open(paths[0]) as f:
            return f.read()
    except:
        pass

def run():
    load_config(["config.json"])

    File 2: live/scan2.py

    """Live run 2: eval on input, assert in production code, unclosed file."""

    def run(user_input):
    return eval(user_input)

def check(value):
    assert value > 0
    return value

def read_log(path):
    f = open(path)
    data = f.read()
    return data
    • Read your context and instructions
    • Compiled the python bugpattern
    {
  "audit_status": "CRITICAL",
  "findings": [
    {
      "id": "f1",
      "file": "live/scan1.py",
      "line": 5,
      "severity": "HIGH",
      "signature": "MUTABLE_DEFAULT_ARG",
      "message": "function 'load_config' uses a mutable default argument []",
      "snippet": "def load_config(paths=[]):"
    },
    {
      "id": "f2",
      "file": "live/scan1.py",
      "line": 9,
      "severity": "HIGH",
      "signature": "BARE_EXCEPT",

      "message": "bare except catches KeyboardInterrupt and SystemExit",
  "snippet": "except:"

        },
    {
      "id": "f3",
      "file": "live/scan1.py",
      "line": 10,
      "severity": "HIGH",
      "signature": "SWALLOWED_EXCEPTION",

      "message": "exception swallowed with 'pass' and no logging",
  "snippet": "pass"

        },
    {
      "id": "f4",
      "file": "live/scan2.py",
      "line": 3,
      "severity": "HIGH",
      "signature": "EVAL_ON_INPUT",

      "message": "eval called on a non-literal argument 'user_input'",
  "snippet": "return eval(user_input)"

        },
    {
      "id": "f5",
      "file": "live/scan2.py",
      "line": 7,
      "severity": "LOW",
      "signature": "ASSERT_IN_PRODUCTION",

      "message": "assert in production code disappears under python -O",
  "snippet": "assert value > 0"

        },
    {
      "id": "f6",
      "file": "live/scan2.py",
      "line": 12,
      "severity": "MEDIUM",
      "signature": "UNCLOSED_FILE",
      "message": "open() called without 'with' and handle is not closed",
      "snippet": "f = open(path)"
    }
  ],
  "metadata": {
    "version": "1.0.0",
    "timestamp": "2026-10-16T12:00:00Z",
    "files_scanned": 2,
    "calls_found": 6
  }
}

    Connects securely to your tools. The creator never sees your data.

    About this skill

    Stop debugging silent production incidents, hidden runtime failures, and unhandled structural vulnerabilities that bypass code reviews. Python BugPattern is a static AST-driven architectural auditor that deep-scans Python codebases to isolate six severe anti-patterns and fragile execution paths before code reaches production staging checkpoints.

    True runtime stability cannot be achieved by relying on human diligence during pull requests. This engine functions as an air-gapped pre-flight gate, evaluating code structure inside secure local memory blocks to enforce deterministic safety boundaries.

    What it does

    • Silent Exception Interception: Deep-scans exception blocks via Abstract Syntax Tree (AST) patterns to expose swallowed exceptions where errors are suppressed without active logging.
    • Bare Except Isolation: Flags dangerous unqualified except: statements that accidentally intercept clean system shutdown signals (KeyboardInterrupt, SystemExit).
    • Mutable Default Detection: Identifies function definitions utilizing mutable default arguments ([], {}), eliminating hidden cross-session state corruption.
    • Production Assert Auditing: Scans functional source layers outside test directories to isolate assert statements that silently disappear under production optimization flags (python -O).
    • Arbitrary Code Execution Guard: Detects hazardous eval() and exec() invocations driven by dynamic runtime parameters or unverified input hooks.
    • Machine-Readable Telemetry: Outputs a strict, schema-validated JSON payload optimized for local pre-commit hooks, IDE diagnostic buffers, or automated CI/CD code review gates.

    Detected Structural Vulnerabilities

    1. SWALLOWED_EXCEPTION: An except clause containing only pass or return None with absolute zero telemetry logging or context re-raising.
    2. BARE_EXCEPT: Exception tracking blocks missing explicit type qualifiers, breaking native interpreter lifecycle controls.
    3. UNCLOSED_FILE: Resource allocation hooks calling open() outside of a synchronized with context or a dedicated finally settlement block.
    4. MUTABLE_DEFAULT_ARG: Class or method structures binding list/dict literals to default argument arrays, corrupting shared memory allocation states.
    5. EVAL_ON_INPUT: Dynamic shell execution blocks routing non-literal parameters straight into compilation functions.
    6. ASSERT_IN_PRODUCTION: Core business logic validations relying on assert keywords outside dedicated testing directories.

    When to use

    • Conducting rigid compliance validations across distributed FastAPI, Django, or Flask web gateways.
    • Reviewing automated AI-generated codebase modifications within Cursor or Claude Code to prevent structural regressions.
    • Integrating a zero-hallucination security and quality gate directly into local Git pre-commit pipelines.

    When NOT to use

    • Monitoring active runtime environments (this engine functions strictly in a passive static analysis orientation).
    • Codebases outside native Python text files and structural runtime layout specifications.
    • Scanning standalone prototyping tools or minimal utilities under 300 total lines of code volume.

    Under the Hood & Security

    • 100% Local & Air-Gapped: Operates entirely utilizing native Python stdlib parsing metrics (file_system_write: false). Absolute zero outbound network queries ensure proprietary code layout structures and internal data components never leak.
    • Contract-Tested Stability: Backed by a rigorous 12-point testing harness validating schema compliance boundaries, edge cases, and absolute zero-hallucination execution.

    Find more skills like this on the Claude Skills Marketplace, the Codex Skills Marketplace and the Gemini Skills Marketplace, or browse Claude Skills for Code Quality & Review.

    Static analysis constraints only. Inspects source layout token parameters inside local memory buffers without initiating runtime compilation, executing live unit tests, or modifying system file trees. Heuristic exception tracking flags block scopes whose body contains only primitive pass/return statements without tracing dynamic logger routing definitions. Bypassed on configurations under 300 lines of total application logic.

    How to use

    1. 1

      Connect your agent to the Agensi MCP

      Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup

    2. 2

      Sign in to Agensi

      Your agent shows a sign-in link. Sign in and click Allow.

    3. 3

      Ask for what you need

      Your agent loads this skill and uses it on your task. It always asks before buying a skill.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill goes through the trust checks below.

    Security scanned

    Checked by our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scan

    Security scan passed 29 days ago

    Software
    Python

    Permissions

    Read Files

    Read-only sandbox access to Python source files. Programmatically evaluates programming anti-patterns, resource leaks, and execution metrics completely offline within secure memory configurations, with absolute zero permission for dynamic shell execution, directory file mutation, or external cloud telemetry.

    Listed29 days ago

    What's inside

    Frequently Asked Questions

    The engine targets six structural vulnerabilities via offline AST call-graph expression mapping: swallowed exceptions, bare except clauses, unclosed file handles, mutable method default arguments, unsafe eval/exec functions on dynamic inputs, and production assert statements.

    No environment configurations, extra parameter arrays, or dynamic vendor package installations required. The validator runs entirely via native Python standard library abstractions, making it completely environment-agnostic and ready for immediate deployment.

    Yes. The skill outputs a flat, schema-validated JSON contract containing explicit diagnosis markers: file targets, accurate line metrics, standardized rule signatures, and severity levels. This structure integrates natively with local git hooks or enterprise CI/CD verification pipelines.

    Absolutely not. The tool operates strictly as a passive, read-only validation gate within localized memory buffers. It parses repository syntax configurations completely offline, ensuring zero runtime execution dependencies or outbound network telemetry phone-home vectors.

    Standard LLM prompts suffer from context degradation and output inconsistencies, frequently hallucinating syntax constraints or dropping edge-case validation rules during extended sessions. This skill bypasses heuristic guessing models by executing direct, deterministic Abstract Syntax Tree (AST) pattern matching backed by a non-zero exit validation gate and a strict machine-readable JSON contract.

    New in Code Quality & Review