Packages
nous
0.16.1
0.17.0
0.16.6
0.16.5
0.16.4
0.16.3
0.16.2
0.16.1
0.16.0
0.15.8
0.15.7
0.15.6
0.15.5
0.15.4
0.15.3
0.15.2
0.15.1
0.15.0
0.14.3
0.14.2
0.14.1
0.14.0
0.13.3
0.13.2
0.13.1
0.13.0
0.12.17
0.12.16
0.12.15
0.12.14
0.12.13
0.12.12
0.12.11
0.12.9
0.12.7
0.12.6
0.12.5
0.12.3
0.12.2
0.12.0
0.11.3
0.11.0
0.10.1
0.10.0
0.9.0
0.8.1
0.8.0
0.7.2
0.7.1
0.7.0
0.5.0
AI agent framework for Elixir with multi-provider LLM support
Current section
Files
Jump to
Current section
Files
lib/nous/skills/python_security.ex
defmodule Nous.Skills.PythonSecurity do
@moduledoc "Built-in skill for Python security best practices."
use Nous.Skill, tags: [:python, :security, :vulnerability], group: :review
@impl true
def name, do: "python_security"
@impl true
def description,
do: "Python security: safe deserialization, SQL injection prevention, input validation"
@impl true
def instructions(_agent, _ctx) do
"""
You are a Python security specialist. Enforce these rules:
1. **Safe deserialization only**: Never deserialize untrusted data with unsafe methods. Use `json.loads()` or Pydantic validation. Use `yaml.safe_load()` instead of `yaml.load()`.
2. **SQL injection prevention**: Always use parameterized queries or ORM methods. Never concatenate user input into query strings.
3. **Input validation at boundaries**: Use Pydantic models for all external input. Allowlist valid values, don't blocklist.
4. **Password hashing**: Use `bcrypt`, `argon2`, or `scrypt`. Never MD5/SHA1 for passwords.
5. **Never hardcode credentials**: Use environment variables or secrets managers.
6. **Subprocess safety**: Use `subprocess.run()` with `shell=False` and explicit argument lists. Avoid shell=True with user input.
7. **Dependency auditing**: Use `pip-audit` or `safety` to check for known CVEs in dependencies.
8. **HTTPS only**: No sensitive data over HTTP. Validate TLS certificates.
9. **No dynamic code evaluation**: Never run user-provided strings as Python code.
10. **Principle of least privilege**: Minimal permissions for API keys, database users, and file access.
"""
end
end