fix: Address high-severity bandit issues

scripts/validate-theme.py

@@ -1,6 +1,7 @@
 #!/usr/bin/env python3
 """
-DSS Theme Validation Script
+DSS Theme Validation Script.
+
 Validates that themes only override tokens defined in the skin contract.
 
 Usage: python3 scripts/validate-theme.py [--theme THEME_NAME] [--skin SKIN_NAME]
@@ -8,9 +9,8 @@ Usage: python3 scripts/validate-theme.py [--theme THEME_NAME] [--skin SKIN_NAME]
 Defaults to validating all themes against the skin contract.
 """
 
-import sys
-import os
 import json
+import sys
 from pathlib import Path
 from typing import Dict, List, Set, Tuple
 
@@ -19,7 +19,7 @@ DSS_DATA = DSS_ROOT / ".dss"
 
 
 def load_json(path: Path) -> dict:
-    """Load JSON file"""
+    """Load JSON file."""
     if not path.exists():
         return {}
     with open(path) as f:
@@ -27,7 +27,7 @@ def load_json(path: Path) -> dict:
 
 
 def get_contract_tokens(contract: dict) -> Dict[str, Set[str]]:
-    """Extract required token names from contract by category"""
+    """Extract required token names from contract by category."""
     required = contract.get("required_tokens", {})
     result = {}
     for category, data in required.items():
@@ -37,7 +37,7 @@ def get_contract_tokens(contract: dict) -> Dict[str, Set[str]]:
 
 
 def get_theme_tokens(theme: dict) -> Dict[str, Set[str]]:
-    """Extract token names from theme by category"""
+    """Extract token names from theme by category."""
     result = {}
     for key, value in theme.items():
         if key.startswith("_"):
@@ -61,14 +61,12 @@ def get_theme_tokens(theme: dict) -> Dict[str, Set[str]]:
 
 
 def get_skin_tokens(skin: dict) -> Dict[str, Set[str]]:
-    """Extract token names from skin by category"""
+    """Extract token names from skin by category."""
     return get_theme_tokens(skin)  # Same structure
 
 
 def validate_theme(
-    theme_path: Path,
-    contract_path: Path,
-    skin_path: Path = None
+    theme_path: Path, contract_path: Path, skin_path: Path = None
 ) -> Tuple[bool, List[str], List[str]]:
     """
     Validate a theme against the skin contract.
@@ -137,10 +135,7 @@ def validate_theme(
     return is_valid, errors, warnings
 
 
-def validate_skin(
-    skin_path: Path,
-    contract_path: Path
-) -> Tuple[bool, List[str], List[str]]:
+def validate_skin(skin_path: Path, contract_path: Path) -> Tuple[bool, List[str], List[str]]:
     """
     Validate that a skin provides all required contract tokens.
 
@@ -176,16 +171,12 @@ def validate_skin(
         skin_category = skin_tokens[category]
         missing = required - skin_category
         if missing:
-            errors.append(
-                f"Skin missing required tokens in '{category}': {sorted(missing)}"
-            )
+            errors.append(f"Skin missing required tokens in '{category}': {sorted(missing)}")
 
         # Note extra tokens (not an error, just info)
         extra = skin_category - required
         if extra:
-            warnings.append(
-                f"Skin has extra tokens in '{category}' (OK): {sorted(extra)}"
-            )
+            warnings.append(f"Skin has extra tokens in '{category}' (OK): {sorted(extra)}")
 
     is_valid = len(errors) == 0
     return is_valid, errors, warnings
@@ -197,7 +188,9 @@ def main():
     parser = argparse.ArgumentParser(description="Validate DSS themes and skins")
     parser.add_argument("--theme", help="Theme name to validate (default: all)")
     parser.add_argument("--skin", help="Skin name to validate (default: shadcn)")
-    parser.add_argument("--validate-skin", action="store_true", help="Validate skin against contract")
+    parser.add_argument(
+        "--validate-skin", action="store_true", help="Validate skin against contract"
+    )
     parser.add_argument("--quiet", "-q", action="store_true", help="Only show errors")
     args = parser.parse_args()
 
@@ -238,10 +231,11 @@ def main():
     if args.theme:
         themes = [args.theme]
     else:
-        themes = [
-            p.stem for p in themes_dir.glob("*.json")
-            if not p.stem.startswith("_")
-        ] if themes_dir.exists() else []
+        themes = (
+            [p.stem for p in themes_dir.glob("*.json") if not p.stem.startswith("_")]
+            if themes_dir.exists()
+            else []
+        )
 
     for theme_name in themes:
         theme_path = themes_dir / f"{theme_name}.json"
@@ -249,9 +243,7 @@ def main():
         print(f"\n[THEME] Validating: {theme_name}")
         print("-" * 40)
 
-        is_valid, errors, warnings = validate_theme(
-            theme_path, contract_path, skin_path
-        )
+        is_valid, errors, warnings = validate_theme(theme_path, contract_path, skin_path)
 
         if errors:
             all_valid = False