Stop 13 · Security Tools & AutomationTopics · 4/8

Building Custom Security Scripts

In short

Big tools cover common needs, but every team has odd jobs no product handles. A small custom script, built carefully, fills that gap and keeps paying back every week.

Combining Phase 13's scripting skills into reusable tools for recurring tasks — a custom script that saves 10 minutes every day compounds into significant time savings over a career.

The blob as a tailor wraps a measuring tape around a dummy beside a sewing machine.

Think of it like this

The tailor's custom fit

Ready made kurtas fit most people roughly. When nothing fits, you go to the tailor, who measures you and stitches exactly what you need. Custom scripts are tailored tools: measured for your logs, your systems and your team's habits.

Watch it happen

Anatomy of a solid script

Arguments

Validate

Work

Output

Exit code

1/5Take inputs as command line arguments, not edits inside the code, so anyone can run it.

The big ideas

What you need to know

argparse gives --help

Python's argparse builds a help message for free. Future you will thank present you.

Read only by default

Make scripts report first. Add a separate --fix or --apply flag for anything that changes systems.

Test on samples

Keep small sample inputs next to the script and test on them before pointing it at real data.

A short README

Write what it does, how to run it and an example output. A script nobody understands gets deleted.

See it in code

Walk through the code

python

1import argparse, hashlib, json, pathlib, sys2 3def sha256(p: pathlib.Path) -> str:4    return hashlib.sha256(p.read_bytes()).hexdigest()5 6ap = argparse.ArgumentParser(description="Check files against a saved hash baseline")7ap.add_argument("baseline", help="JSON file mapping path -> sha256")8args = ap.parse_args()9 10changed = 011for path, expected in json.loads(pathlib.Path(args.baseline).read_text()).items():12    p = pathlib.Path(path)13    status = "MISSING" if not p.exists() else ("OK" if sha256(p) == expected else "CHANGED")14    changed += status != "OK"15    print(f"{status:8} {path}")16sys.exit(1 if changed else 0)

1/4One small function does the hashing, easy to test on its own.

A tiny file integrity checker: compare important files against known good hashes and flag anything missing or modified.

Save yourself the pain

Common mistakes

Oops

Scripts that silently do nothing when the input path is wrong.

Do this instead

Validate inputs and fail loudly with a clear error. Silent success hides real problems.

Oops

Making a script change systems on its first run.

Do this instead

Default to report only. Require an explicit flag for any change, and log what was changed.

Your mission

Build a baseline checker

~40 min

Quick check

Why should a security script exit with a non zero code when it finds a problem?

Go deeper

1Identify a recurring manual task from your own practice work and script it.
2Learn to add basic error handling so your script fails gracefully instead of silently.
3Practice sharing or documenting your script well enough that a peer could use it too.