Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Sep 22, 2026

Static Code Analysis

Find shell injection in a Python folder

bandit is the Python Code Quality Authority's security linter that parses Python source into an abstract syntax tree and runs it through a battery of plugin tests to flag issues such as SQL injection, weak cryptography, and unsafe deserialization.

installpip install banditdocker pull ghcr.io/pycqa/bandit/bandit

Python · Apache-2.0 license

Agent
Scan application sourceCatch shell invocationHand JSON to triage

overview

What bandit does

Bandit reads a connected folder of Python files, parses each file into an AST, and writes a JSON report of plugin hits.

A Managed-fleet smoke on a two-line script that calls subprocess with shell=True returned B602, the shell-injection check, in that JSON report.

Connect the folder that holds the .py files. A bare text file is not scanned as Python.

source github.com/PyCQA/bandit

use cases

Where bandit fits

Scan application source

Point Bandit at the folder that contains the Python modules you ship.

Catch shell invocation

Surface subprocess calls that pass shell=True before that code runs.

Hand JSON to triage

Keep the plugin id, filename, and issue text in one report for a later node.

reference

bandit inputs and flags

1 inputs
NameTypeFlagDescription
sourceFOLDER--sourceFolder of Python source to scan.

Showing key inputs. bandit exposes 1 inputs in total.

example

Run bandit

bandit · command
bandit --source ./src
sample output
{"test_id": "B602", "issue_severity": "LOW", "filename": "app.py", "issue_text": "subprocess call with shell=True seems safe, but may be changed in the future, consider rewriting without shell"}

guidance

Choosing bandit

Use Bandit when the artifact is Python source. Use Semgrep for multi-language rules, and OSV-Scanner when the question is a lockfile advisory.

semgrep-scan

Runs custom rules across more languages than Python.

osv-scanner

Matches lockfiles to known vulnerability advisories.

gosec

Looks for security problems in Go source.

faq

bandit questions

Python files inside the connected folder. The smoke fixture was app.py.

Connect a folder. The node scans the Python files inside it.

JSON with a test id such as B602, a filename, a severity, and the issue text.

No. An empty results list means the plugins found nothing in that folder.

related

More Static Code Analysis tools

  1. gitleaks

    Detect hardcoded secrets in git repos and plain directories.

  2. gosec

    Go AST security scanner for credentials, crypto, and injection.

  3. guarddog

    A package coordinate in, indicator hits out.

  4. malcontent-scan

    A package coordinate in, behavior findings out.

  5. osv-malicious

    A package coordinate in, malware advisory rows out.

  6. osv-scanner

    A lockfile in, advisory rows out.

Run bandit yourself

A folder containing app.py with subprocess.call and shell=True produced a JSON report that included B602.

Run bandit in TrickestBrowse the library

Facts on this page come from the live Trickest tool library.