Openclaw Skills Python Hardener transforms one or more Python scripts into secure, production-ready versions with better errors, logging, docs, and safer I/O.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install skill-python-hardener
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install skill-python-hardener using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Python Hardener?
Python Hardener is an Openclaw Skills workflow for taking uploaded or referenced Python files and rewriting them in place with safer control flow, cleaner structure, and production-grade observability.
It performs a full review for injection risks, weak exception handling, resource leaks, unsafe path and subprocess usage, non-atomic writes, and missing documentation, then produces a companion Markdown file that explains the security measures applied and how each module works.
Python Hardener Use Cases
- Review Python scripts for SQL/NoSQL injection, shell injection, path traversal, or hardcoded secrets.
- Replace bare
except:blocks and silentpassstatements with specific exceptions and explicit logging. - Convert print-driven scripts to centralized logging with
RotatingFileHandlerand a consoleStreamHandler. - Refactor messy code into clearer functions, better variable names, and type-hinted interfaces.
- Harden multiple uploaded
.pyfiles in one pass while preserving the original filenames exactly. - Produce a single companion Markdown document for auditability, onboarding, or handoff.
- Make one-off utilities production-ready without inventing new project scaffolding or migration files.
How Python Hardener Works
- Read all provided Python files end to end and build a mental inventory of issues across security, error handling, performance, resource management, and clean code.
- Identify unsafe patterns such as interpolated SQL,
shell=True,os.chdir(), path traversal, hardcoded secrets, and broad exception handlers, then choose safer replacements. - Rewrite the same files in place, preserving the original filenames and overall structure unless a name or pattern is actively harmful.
- Apply production logging once via a dedicated setup function, using
RotatingFileHandlerfor file output,StreamHandlerfor console output, and an environment-driven log level. - Add Google-style docstrings and type hints to public functions, methods, and classes, including
Args,Returns, andRaisescoverage. - Generate one companion Markdown document named
<primary-script-name>.mdthat documents the architecture, configuration, APIs, security fixes, and error handling behavior. - Verify the final output against the checklist: no bare
except:, noos.chdir(), closed resources, atomic writes, and no extra files beyond the approved documentation artifact.
Python Hardener Setup
- Provide the target
.pyfile or files and request hardening; no separate install step is required for Openclaw Skills. - If the script already relies on runtime configuration, set the environment variables before executing the hardened output.
export LOG_LEVEL=INFO
- Run the rewritten files from their original locations; filenames remain unchanged.
- Review the generated
<primary-script-name>.mdcompanion document for the applied fixes and module behavior.
Do not expect the skill to create .env.example, requirements.txt, or migration guides unless you explicitly ask for them.
Python Hardener Data Schema & Taxonomy
| Artifact | Structure | Purpose |
|---|---|---|
| Input scripts | One or more .py files supplied by the user |
Source code to analyze and harden |
| Patched scripts | The same filenames as the input files | Corrected code written in place |
| Companion documentation | <primary-script-name>.md |
Single Markdown report for the primary script |
| Runtime configuration | Environment variables consumed by the script | Replaces hardcoded secrets and controls log level |
| Metadata bucket | Typical contents | Notes |
|---|---|---|
| Security | SQL/NoSQL injection, shell injection, path traversal, secrets | Each threat maps to an explicit countermeasure |
| Error handling | Specific exceptions, warnings, error logs, fallback behavior | Bare except: and silent pass are removed |
| Resource management | Context managers, connection closure, atomic writes | Prevents leaks and torn writes |
| Code quality | Type hints, naming, function decomposition, docstrings | Preserves intent while improving readability |
| Documentation | Overview, architecture, configuration, API/functions, security, error handling | Captures the final state for review |
The skill does not generate extra scaffolding files or a persistent schema beyond the rewritten source and the single Markdown artifact.
Python Hardener Advanced Features
- Multi-file hardening support: when multiple Python files are uploaded together, each file is reviewed and fixed.
- Allowlist-driven defenses for risky inputs, including table names, paths, and other user-controlled values.
- Safer subprocess handling with list-form commands and no
shell=True. - Resource-leak remediation using context managers for files, database connections, and network handles.
- Atomic file writes with temporary files plus
os.replace()to prevent torn state updates. - Logging modernization that reads log level from the environment and standardizes file and console output.
- Documentation generation that captures architecture, security posture, API surface, and error behavior in a single companion file.
- Preserves the original filenames and avoids unnecessary project scaffolding, making it ideal for Openclaw Skills review-and-fix workflows.
SKILL.md
Loading
Related Openclaw Skills
Skill Batch Publisher
Skill Batch Publisher turns a local Openclaw Skills library into a safe, resumable ClawHub publish queue.
Lazaretto Pre-Install Verification
Lazaretto helps Openclaw Skills users verify untrusted skills and packages before install by checking known-bad hashes, scanning behavior, and revalidating on-disk bytes.
ProxyLLM Account Setup
Openclaw Skills for ProxyLLM lets an agent create, verify, and configure a gateway account, then provision fallback routing keys without a browser.
TianAPI Ancient Books Lookup
Openclaw Skills for querying ancient Chinese classic chapters by ID through TianAPI, with script and direct HTTP access.
Wedding Speech
An Openclaw Skills assistant that turns rough notes into a concise, audience-safe wedding toast with a strong emotional arc.
Portfolio Page
Openclaw Skills turns a project list into an evidence-driven portfolio page that shows your role, impact, and proof.
Featured*
