The proliferation of software security vulnerabilities in modern applications has created an urgent demand for automated, intelligent, and scalable detection systems. Existing rule-based static analysis tools are effective for predefined vulnerability patterns but may have difficulty with variations that are not adequately covered by their rules, and a substantial portion of existing machine-learning-based vulnerability detection research focuses on C and C++ programs, while Python-specific approaches remain comparatively less explored. This paper presents a static code analysis framework for automated security vulnerability detection specifically targeting Python source code. The proposed framework implements a three-phase experimental pipeline: Phase 1 establishes a token-based TF-IDF baseline by representing source code as typed token pairs and training classical machine learning classifiers; Phase 2 introduces up to 35 hand-engineered structural features extracted from the Abstract Syntax Tree (AST) of each code snippet using the NodeVisitor design pattern; and Phase 3 combines both feature types into a unified representation and retrains all classifiers — Random Forest, Gradient Boosting, Logistic Regression, and Support Vector Machine. The system is trained and evaluated on a manually constructed, balanced dataset of 70 Python code snippets covering five high-severity CWE vulnerability categories: SQL Injection (CWE-89), OS Command Injection (CWE-78), Path Traversal (CWE-22), Insecure Deserialization (CWE-502), and Cross-Site Scripting (CWE-79). Recall is designated as the primary optimization metric because missed vulnerabilities carry greater risk than false alarms in security-critical deployment contexts. Experimental results show that AST-based structural features substantially improve recall compared with the TF-IDF baseline, while the combined TF-IDF and AST representation maintains this improved performance. The complete system is deployed as a command-line prediction tool producing a binary verdict, a continuous risk score, and a structured report of detected dangerous API patterns, and runs entirely on standard consumer hardware without GPU or deep-learning infrastructure requirements.