st.markdown(f"<h2>Notes for {name}</h2>", unsafe_allow_html=True) puts whatever a visitor types into your page as HTML, and demo.launch(share=True, allowed_paths=["/"]) lets anyone with the link download any file on your machine. This skill finds those and the other Streamlit and Gradio mistakes listed below before you deploy or share the app, and tells you how to fix each one.

Your agent runs a scanner on your app's Python files (those that import streamlit or gradio), .streamlit/config.toml, secrets.toml, and the Dockerfiles, Procfiles, compose files and shell scripts that start the app. It follows values that come from visitors (input widgets, query parameters, uploaded files, the signed-in user's name, the session-state keys that widgets and chat history fill, the free-text arguments of Gradio event handlers) through assignments and into the file's own helper functions. It treats Gradio Dropdown, Radio, Slider and Number values as fixed choices, recognises fixes such as html.escape, shlex.quote, ast.literal_eval and lookups in a constant table, follows import aliases such as import subprocess as sp, reads your .gitignore files to see whether secrets.toml is kept out of git, and knows the Streamlit and Gradio defaults (XSRF and CORS protection on, st.html sanitized, Gradio bound to 127.0.0.1 with strict CORS and chat sanitizing on). It never runs your app or connects anywhere. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• D01: a secrets.toml holding real keys or passwords that no .gitignore rule covers
• D02: visitor input rendered as HTML with unsafe_allow_html=True, st.html with JavaScript allowed, st.iframe or the deprecated st.components.v1.html
• D03: Gradio allowed_paths, set_static_paths or GRADIO_ALLOWED_PATHS that include the disk root, a drive root, the home folder, /home, /Users, /root or /etc
• D04: visitor input reaching eval, exec, compile, a shell command, or a pickle-style loader (pickle, joblib, dill, cloudpickle, pandas.read_pickle and similar)
• D05: API keys and secrets written in app code, config.toml or run files (provider key formats, random-looking values under secret names, passwords in database URLs)

REVIEW (check before release)

• D11: Gradio launch(share=True) or server_name="0.0.0.0" without auth or auth_dependency
• D12: Streamlit XSRF protection turned off, or its cookie sent cross-site
• D13: Streamlit enableCORS = false or Gradio strict_cors=False
• D14: uploads without a type limit (st.file_uploader without type, Gradio file inputs without file_types)
• D15: error details shown to visitors (Gradio show_error=True, an explicit Streamlit showErrorDetails of full or stacktrace)
• D16: Gradio sanitize_html=False on a Chatbot or Markdown
• D17: st.secrets, a secret or a whole section from it, or the process environment (including getenv of a key) shown on the page
• D18: login passwords written in code (Gradio auth tuples, password == "..." checks, password variables)

What's included

• The scanner (Python 3.9+, standard library only)
• A rules guide with the reason, safer approach and official documentation link for each rule
• A risky and a safe example project, and the real report the scanner produces on the risky one

Limits

It reads each file on its own and follows values in straight-line order: values passed between modules, kept on class attributes or built in branches are not followed, Gradio handlers given as class methods or through functools.partial are not followed, and Python files that import neither Streamlit nor Gradio are not checked. Gradio gr.HTML output is not checked, because Gradio does not document whether it sanitizes it. It reads .gitignore files but not git history, so a secrets.toml committed before it was ignored is not detected. Settings made in a hosting dashboard (Streamlit Community Cloud, Hugging Face Spaces) are not visible. Gradio debug=True is not reported, because it only keeps the script running. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 22 files: SKILL.md, the scanner in scripts/ (8 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (11 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.