Install
$ agentstack add skill-narumiruna-skills-python ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Python
Core Posture
Use uv as the default workflow for Python projects, standalone scripts, dependency management, quality checks, and package release. Prefer the repository's existing configuration and documented commands over introducing new tooling.
Mode Selection
- Choose project mode when the work has a
pyproject.toml, shared package code, or lockfile. - Treat a brand-new repository created with
uv initas project mode. - Choose standalone-script mode when the work is a single file, stdin snippet, or ad hoc invocation that should not become a full project.
- Treat a script inside a project as project mode when it imports local package code.
- Use
--no-projectonly when a script must ignore the surrounding project.
Project Workflow
- Inspect
pyproject.toml, lockfiles, repository docs, and existing test/tooling choices before changing dependencies or commands. - For a brand-new project, run
uv init, then install the default dev toolchain withuv add --dev ruff ty pytest pytest-cov. - Use pytest as the default test framework for new projects: function-based
tests/test_*.pyfiles with plainassert. - Add dependencies with
uv add; remove them withuv remove; reconcile external dependency changes withuv sync. - Run project Python, tests, and tools through
uv rununless the repository provides a documented wrapper command; for pytest, default to an explicitteststarget when the project does not document another test location. - Run the repository quality gate before finalizing dependency or code changes.
Standalone Script Workflow
- Decide whether the script should use project dependencies, one-off
--withdependencies, or inline metadata. - Use plain
uv run script.pywhen no extra dependencies are needed. - Use
uv run --with ... script.pyfor disposable per-invocation dependencies. - Use
uv init --scriptanduv add --scriptwhen dependencies should live with the script. - Put
--no-projectbefore the script name, and never use it for a script that imports local package code. - Use
uv run --pythonorrequires-pythonin metadata when the script needs a specific Python version. - Read
references/scripts.mdfor stdin, heredoc, shebang, alternate indexes, Windows.pyw, locking, and reproducibility details.
Non-Negotiable Rules
- Manage dependencies with
uv add,uv remove, anduv sync; do not usepip installto mutate a project environment. - Run Python, pytest, scripts, and Python tools with
uv rununless a repository command wraps them; when no project-specific pytest target is documented, includetestsexplicitly (for example,uv run pytest tests) rather than bareuv run pytest. - Follow existing repository choices; do not migrate test frameworks, hook runners, or tool configuration unless asked.
- For a brand-new project, immediately add
ruff,ty,pytest, andpytest-cov; do not start withunittest,unittest.TestCase, or class-basedTest*suites. - Do not create a
pyproject.tomlonly to run a one-file script. - Treat
uv run --withas disposable; use inline metadata when the script should be shared or reused. - Build release artifacts with
uv build --no-sourcesso local[tool.uv.sources]overrides do not leak into release output. - Test installs from the built wheel or published artifact, not only from the source checkout.
Quality Gate Priority
Use this order before finalizing code, dependency, or packaging changes:
- The repository's documented aggregate gate.
prek run -awhen the repo uses prek.- The documented
pre-commitcommand when the repo uses pre-commit and provides no prek path. - Individual
uv run ...commands only when no aggregate gate exists or when narrowing failures.
Do not introduce or switch hook runners only for verification. Read references/quality.md for command details, coverage, CI examples, and fallback checks.
Release Workflow
- Run the repository quality gate.
- Build artifacts in
dist/withuv build --no-sources. - Inspect wheel and sdist contents.
- Test install from the built wheel or published artifact in a fresh uv-managed invocation.
- Read
references/packaging.mdfor publish commands, Test PyPI flow, and artifact inspection details.
Common Mistakes
- Treating a one-file script as project work when inline metadata or
--no-projectwould be smaller and clearer. - Using
--no-projectfor a script that imports local package code. - Keeping reusable script dependencies only in
uv run --with ...shell history instead of the script metadata. - Starting a brand-new project with
unittestor without the default dev toolchain. - Running tools outside uv.
- Publishing before verifying artifacts.
References
references/quality.md- Full commands, CI examples, coverage, prek, and pre-commit fallback usage.references/packaging.md- Build, inspect, and publish details.references/scripts.md- Standalone script patterns, inline metadata, locking, and special cases.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: narumiruna
- Source: narumiruna/skills
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.