python-secure-codinglisted

# python-secure-coding ## Purpose Produce Python code that passes the repository's `ruff` and `ty` checks cleanly, and that additionally follows Python security best practices no linter fully verifies on its own. This skill is a triage layer: it routes the change to the security detail that applies to it, then holds the change to a bounded verify loop. The per-category detail lives in `references/`, read on demand rather than up front. ## When to use this - Authoring or modifying Python source in a repository that adopts these instructions. - Any change that touches user input, deserialization, subprocess/OS/shell calls, SQL or other query construction, templating, cryptography, passwords, secrets/credentials, server-side HTTP requests to user-influenced destinations, or access control. ## When NOT to use this - Non-Python changes. ## Steps 1. Read the tooling baseline in `instructions/python_coding_instructions.md` (see below) and follow it. It is the single source of truth for the `ruff`/`ty` workflow and for the judgment items no tool checks. 2. Identify which change types in the triage table below the change matches, and read those reference files. Read only what applies; the table is the index, not a reading list. 3. Write or modify the code, applying that guidance. 4. Run the verify loop below until it is clean or the bound is reached. 5. State the security reasoning for any non-obvious call in the commit message or PR description. ## Tooling basel