Tommaso Bona

PySpector runs full security audits on Python codebases, performing SAST scans, vulnerability detection, and dependency/CVE checks. It selects scan flags based on the codebase, verifies findings against real source code, and produces a readable security report.

PySpector targets security researchers, Python developers, and AppSec engineers who need to check repositories for vulnerabilities, validate whether code is secure, or audit projects before deployment. It is maintained by an OSS and AI security researcher.

The skill installs PySpector automatically if missing, including its required Rust toolchain. It then inspects the codebase, chooses appropriate scan flags, executes the scan, verifies findings against the source, and generates a readable report.

Yes. PySpector is an open-source project hosted on GitHub at github.com/ParzivalHack/PySpector, maintained as OSS by Tommaso Bona. It can be installed and used at no cost for auditing Python codebases.

PySpector requires a Rust toolchain, which the skill installs automatically. It only works on Python codebases and is not intended for non-Python projects, generic non-security code review, or patching vulnerabilities after a report exists.