The Complete Production SOP: How to Deploy and Run pip-audit Python Package Vulnerability Auditor in Autonomous AI Agents

---
name: "pip-audit-python-cve-checker"
description: "Scan Python environments and requirements files for known CVEs via PyPI Advisory DB."
metadata:
  author: "Trail of Bits"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "run pip-audit python"
  - "scan requirements.txt for cves"
  - "auto fix vulnerable python packages"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: true
  net_access: true
---

# pip-audit Python Package Vulnerability Auditor

Audits Python packages with Trail of Bits pip-audit: querying PyPA Advisory Database, detecting vulnerable versions, and automatically upgrading requirements to patched releases.

## When to Invoke
Invoke this skill whenever you need to:
- run pip-audit python
- scan requirements.txt for cves
- auto fix vulnerable python packages

## Execution SOP & Rules
1. Always verify pip-audit is available: `pip-audit --version`.
2. In automated audits, first run structured scan: `pip-audit -r requirements.txt -f json`.
3. When asked to fix, test safe dry-runs first or apply `pip-audit -r requirements.txt --fix`.
4. Re-pin lockfiles or requirements.txt strictly to minimal patched semver releases.
5. Run test suites immediately after patching to prevent regression.

#!/usr/bin/env bash
set -euo pipefail

if ! command -v pip-audit &> /dev/null; then
  echo "[!] pip-audit not found. Installing via pipx..."
  pipx install pip-audit
fi

echo "[*] pip-audit version: $(pip-audit --version)"

Use the pip-audit-python-cve-checker skill to scan requirements.txt for cves. If vulnerabilities exist, evaluate if they can be upgraded automatically using pip-audit --fix, and provide a diff of modified pins.

#!/usr/bin/env bash
set -e

echo "[*] Re-scanning requirements.txt..."
pip-audit -r requirements.txt --strict --dry-run

echo "[*] Running unit tests to guarantee zero regressions..."
pytest tests/

echo "[+] CVE Remediation and functional validation successful."