SG-088: Python bytecode contains sensitive strings
Severity: CRITICAL
A .pyc bytecode file ships in the repo and embeds tokens that suggest credential theft, subprocess execution, or network exfiltration. The interpreter runs bytecode, not source - the visible .py may be a decoy.
Fires when
- File matches Python 3.8-3.13 .pyc magic number, confirming bytecode
- Bytecode contains suspicious tokens: os.environ/subprocess/socket (env access), urllib/requests (network), base64/eval/pickle (decode/exec), or key prefixes (AKIA, ghp_, sk-)
Remediation
Remove the .pyc from version control (it should be a build artifact in .gitignore). Decompile any committed .pyc with `uncompyle6` or `pycdc` and diff against the .py source before trusting the skill.