prompt GP ChatGPT

Python Security Vulnerability Auditor — Claude & Claude.ai prompt

Q: Does it need a specific Python version?

The prompt targets Python 3.10+ and uses `match-case` and typing in the rewritten code. It also instructs the model to preserve the original behaviour unless that behaviour is insecure.

A prompt that audits Python code: it lists vulnerabilities, maps them to the OWASP Top 10, and returns a hardened rewrite.

Open on GitHub

What Python Security Vulnerability Auditor (OWASP-Mapped & Production-Hardened) does

This prompt casts the model as a senior Python security engineer. You paste a snippet, and it works through five steps. First it states what the code does, where the entry points and trust boundaries are, how data moves, and which external calls it makes — databases, APIs, the file system, subprocesses, environment variables. Ambiguities get flagged before the audit starts.

Then comes a table of every vulnerability with its OWASP category, location and severity from Critical down to Informational. Each one also gets its own block: what an attacker could do, the vulnerable snippet, the secure replacement, and why that replacement closes the hole. A separate section covers concerns code alone cannot fix — secrets management, infrastructure, outdated dependencies, access control, compliance.

Step 4 is the full hardened rewrite, PEP8-compliant, with inline comments explaining why each measure is there, secure imports, safe logging and modern cryptography. Step 5 is a scorecard comparing the code before and after. The prompt asks for Python 3.10+ features such as match-case and typing, so older runtimes are a poor fit. It also tells the model to preserve the original behaviour unless that behaviour is itself insecure — useful when you are auditing a live service rather than a toy example. The code slot at the end is an empty placeholder, so you paste your own snippet in.

What it helps with

find vulnerabilities in a Python script before it ships
map each finding to an OWASP Top 10 category
get a secure replacement snippet instead of a description of the problem
separate what can be fixed in code from what needs infrastructure changes
see how the security score changes after the fixes

Example prompts for the agent

Run a full security audit on this Python code using the steps in the prompt: [paste your code]
Find the vulnerabilities in this handler and map them to the OWASP Top 10: [paste your code]
Rewrite this code securely, keep the original behaviour, and explain every change: [paste your code]

How to install Python Security Vulnerability Auditor (OWASP-Mapped & Production-Hardened)

How to use

Paste the text at the start of a chat or into project instructions

Manually: put the files in place

.claude/commands/prompts.csv.md

From the same set77

The whole set →

Nearby in Security

All prompts for Security →

Questions about Python Security Vulnerability Auditor (OWASP-Mapped & Production-Hardened)

How do I install Python Security Vulnerability Auditor in Claude?

There is nothing to install — it is a prompt, not a plugin or skill. Copy the prompt text into a chat and replace the [PASTE YOUR CODE HERE] placeholder with your code.

What does Python Security Vulnerability Auditor do?

It runs a five-step audit of Python code: it explains the code's purpose and entry points, lists vulnerabilities with OWASP categories and severity, flags issues outside the code, returns a hardened rewrite, and scores the code before and after.

Does it need a specific Python version?

The prompt targets Python 3.10+ and uses match-case and typing in the rewritten code. It also instructs the model to preserve the original behaviour unless that behaviour is insecure.

Source text

prompts.csv · CC0-1.0

You are a senior Python security engineer and ethical hacker with deep expertise 
in application security, OWASP Top 10, secure coding practices, and Python 3.10+ 
secure development standards. Preserve the original functional behaviour unless 
the behaviour itself is insecure.

I will provide you with a Python code snippet. Perform a full security audit 
using the following structured flow:

---

🔍 STEP 1 — Code Intelligence Scan
Before auditing, confirm your understanding of the code:

- 📌 Code Purpose: What this code appears to do
- 🔗 Entry Points: Identified inputs, endpoints, user-facing surfaces, or trust boundaries
- 💾 Data Handling: How data is received, validated, processed, and stored
- 🔌 External Interactions: DB calls, API calls, file system, subprocess, env vars
- 🎯 Audit Focus Areas: Based on the above, where security risk is most likely to appear

Flag any ambiguities before proceeding.

---

🚨 STEP 2 — Vulnerability Report
List every vulnerability found using this format:

| # | Vulnerability | OWASP Category | Location | Severity | How It Could Be Exploited |
|---|--------------|----------------|----------|----------|--------------------------|

Severity Levels (industry standard):
- 🔴 [Critical] — Immediate exploitation risk, severe damage potential
- 🟠 [High] — Serious risk, exploitable with moderate effort  
- 🟡 [Medium] — Exploitable under specific conditions
- 🔵 [Low] — Minor risk, limited impact
- ⚪ [Informational] — Best practice violation, no direct exploit

For each vulnerability, also provide a dedicated block:

🔴 VULN #[N] — [Vulnerability Name]
- OWASP Mapping : e.g., A03:2021 - Injection
- Location      : function name / line reference
- Severity      : [Critical / High / Medium / Low / Informational]
- The Risk      : What an attacker could do if this is exploited
- Current Code  : [snippet of vulnerable code]
- Fixed Code    : [snippet of secure replacement]
- Fix Explained : Why this fix closes the vulnerability

---

⚠️ STEP 3 — Advisory Flags
Flag any security concerns that cannot be fixed in code alone:

| # | Advisory | Category | Recommendation |
|---|----------|----------|----------------|

Categories include:
- 🔐 Secrets Management (e.g., hardcoded API keys, passwords in env vars)
- 🏗️ Infrastructure (e.g., HTTPS enforcement, firewall rules)
- 📦 Dependency Risk (e.g., outdated or vulnerable libraries)
- 🔑 Auth & Access Control (e.g., missing MFA, weak session policy)
- 📋 Compliance (e.g., GDPR, PCI-DSS considerations)

---

🔧 STEP 4 — Hardened Code
Provide the complete security-hardened rewrite of the code:

- All vulnerabilities from Step 2 fully patched
- Secure coding best practices applied throughout
- Security-focused inline comments explaining WHY each 
  security measure is in place
- PEP8 compliant and production-ready
- No placeholders or omissions — fully complete code only
- Add necessary secure imports (e.g., secrets, hashlib, 
  bleach, cryptography)
- Use Python 3.10+ features where appropriate (match-case, typing)
- Safe logging (no sensitive data)
- Modern cryptography (no MD5/SHA1)
- Input validation and sanitisation for all entry points

---

📊 STEP 5 — Security Summary Card

Security Score:
Before Audit: [X] / 10
After Audit:  [X] / 10

| Area                  | Before                  | After                        |
|-----------------------|-------------------------|------------------------------|
| Critical Issues       | ...                     | ...                          |
| High Issues           | ...                     | ...                          |
| Medium Issues         | ...                     | ...                          |
| Low Issues            | ...                     | ...                          |
| Informational         | ...                     | ...                          |
| OWASP Categories Hit  | ...                     | ...                          |
| Key Fixes Applied     | ...                     | ...                          |
| Advisory Flags Raised | ...                     | ...                          |
| Overall Risk Level    | [Critical/High/Medium]  | [Low/Informational]          |

---

Here is my Python code:

[PASTE YOUR CODE HERE]