python-kwargs-setattr-security Skill
When reviewing or fixing Python code that uses setattr() with user-controlled kwargs to configure C++ extension objects (SessionOptions, RunOptions, etc.) in ONNX Runtime. Use this to apply the allowlist pattern that prevents arbitrary file writes and other attacks via reflected property access. Published by microsoft in onnxruntime.
Decision snapshot
Is this a fit?
Security review, Includes SKILL.md, Reusable instructions
Compatibility not yet detected.
Permission behavior not yet detected.
Copy skill directory
2 months ago · MIT license
No specific cautions were detected. Review the source and requested permissions before installing.
What is python-kwargs-setattr-security Skill?
When reviewing or fixing Python code that uses setattr() with user-controlled kwargs to configure C++ extension objects (SessionOptions, RunOptions, etc.) in ONNX Runtime. Use this to apply the allowlist pattern that prevents arbitrary file writes and other attacks via reflected property access. Published by microsoft in onnxruntime. This profile combines repository metadata with install, compatibility, and usage signals so developers can quickly decide whether it fits their agent workflow before opening the source repository.
Automated repository signals based on public metadata such as recency, license, installation evidence, and adoption. These are not a security audit or endorsement. See how SkillIndex evaluates profiles.
Key capabilities
- Includes SKILL.md support
- Reusable instructions support
- Security review
- Security review use cases
Declared skill metadata
- Source file: .agents/skills/python-kwargs-setattr-security/SKILL.md
These fields retain source and confidence evidence from the indexed SKILL.md.
Compatibility and setup
- Install or run with Copy skill directory
When to use python-kwargs-setattr-security Skill
- Use it for security review.
Built with
Editorial notes
Source
- Creator: microsoft
- Repository: microsoft/onnxruntime
- Skill file: .agents/skills/python-kwargs-setattr-security/SKILL.md
What it does
When reviewing or fixing Python code that uses setattr() with user-controlled kwargs to configure C++ extension objects (SessionOptions, RunOptions, etc.) in ONNX Runtime. Use this to apply the allowlist pattern that prevents arbitrary file writes and other attacks via reflected property access.
Skill instructions
Problem Pattern Using hasattr(obj, k) / setattr(obj, k, v) with user-controlled kwargs is insecure. The hasattr check is NOT a security guard — it returns True for ALL exposed properties including dangerous ones. python INSECURE — do not use for k, v in kwargs.items(): if hasattr(options, k): setattr(options, k, v) Fix: Explicit Allowlist Define a module-level frozenset of safe attribute names. Raise RuntimeError for known-but-blocked attrs; silently ignore unknown keys. python Define at module level, before the class ALLOWEDSESSIONOPTIONS = frozenset({ "enablecpumemarena", "enablemempattern", ... only explicitly reviewed safe attrs }) In the method for k, v in kwargs.items(): if k in ALLOWEDSESSIONOPTIONS: setattr(options, k, v) elif hasattr(options, k): reuse the existing instance, don't create new raise RuntimeError( f"SessionOptions attribute '{k}' is not permitted via the backend API. " f"Allowed attributes: {', '.join(sorted(ALLOWEDSESSIONOPTIONS))}" ) else: silently ignore (may
Verified compatibility and discovery
Frequently asked questions
What is python-kwargs-setattr-security?
python-kwargs-setattr-security is a open-source AI agent skill with Copy skill directory. When reviewing or fixing Python code that uses setattr() with user-controlled kwargs to configure C++ extension objects (SessionOptions, RunOptions, etc.) in ONNX Runtime.
Who is python-kwargs-setattr-security best for?
python-kwargs-setattr-security is best for reusing agent instructions, scripts, and references, security review workflows.
How do I install python-kwargs-setattr-security?
Install or run python-kwargs-setattr-security using Copy skill directory. Check python-kwargs-setattr-security for the latest setup command.
Is python-kwargs-setattr-security actively maintained?
python-kwargs-setattr-security may need a closer maintenance check before production use.
Project health auto-fetched from the source repository.
Maintain this resource?
Review this source-backed profile, send a correction with evidence, or link to it from your documentation. Claims verify your relationship to the project; profile facts still require source evidence and editorial review.
