---
name: "pip-audit-python-cve-checker"
description: "Scan Python environments and requirements files for known CVEs via PyPI Advisory DB."
metadata:
  author: "Trail of Bits"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "run pip-audit python"
  - "scan requirements.txt for cves"
  - "auto fix vulnerable python packages"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# pip-audit Python Package Vulnerability Auditor

Audits Python packages with Trail of Bits pip-audit: querying PyPA Advisory Database, detecting vulnerable versions, and automatically upgrading requirements to patched releases.

## When to Invoke
Invoke this skill whenever you need to:
- run pip-audit python
- scan requirements.txt for cves
- auto fix vulnerable python packages

## Execution SOP & Rules
1. Execute pip-audit -r requirements.txt in automated CI pipelines.
2. Use the --fix flag to automatically upgrade dependencies to minimum safe versions.
3. Export findings in JSON format (pip-audit -f json) for parsing in security pipelines.
4. Ensure dependencies are pinned with exact versions or hashes in requirements.txt.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.