Install
$ agentstack add skill-wdm0006-python-skills-library-review ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Python Library Review
Quick Health Check (5 min)
git clone https://github.com/user/package && cd package
cat pyproject.toml | head -50 # Modern config?
ls tests/ && pytest --collect-only # Tests exist?
pytest --cov=package | tail -20 # Coverage?
pip install bandit && bandit -r src/ # Security?
Review Dimensions
| Area | Check For | |------|-----------| | Structure | src/ layout, py.typed marker | | Packaging | pyproject.toml (not setup.py) | | Code | Type hints, docstrings, no anti-patterns | | Tests | 80%+ coverage, edge cases | | Security | No secrets, input validation, pip-audit clean | | Docs | README, API docs, changelog | | API | Consistent naming, sensible defaults | | CI/CD | Tests on PR, multi-Python, security scans |
Red Flags 🚩
- No tests
- No type hints
- setup.py only (no pyproject.toml)
- Pinned exact versions for all deps
- No LICENSE file
- Last commit > 1 year ago
Green Flags ✅
- Active maintenance (recent commits)
- High test coverage (>85%)
- Comprehensive CI/CD
- Type hints throughout
- Clear documentation
- Semantic versioning
Report Template
# Library Review: [package]
**Rating:** [Excellent/Good/Needs Work/Significant Issues]
## Strengths
- [Strength 1]
## Areas for Improvement
- [Issue 1] - Severity: High/Medium/Low
## Category Scores
| Category | Score |
|----------|-------|
| Structure | ⭐⭐⭐⭐⭐ |
| Testing | ⭐⭐⭐☆☆ |
| Security | ⭐⭐⭐⭐☆ |
## Recommendations
1. [High priority action]
2. [Medium priority action]
For detailed checklists, see:
- [CHECKLIST.md](CHECKLIST.md) - Full review checklist
- [REPORTTEMPLATE.md](REPORTTEMPLATE.md) - Complete report template
Best Practices Checklist
Essential:
- [ ] pyproject.toml valid
- [ ] Tests exist and pass
- [ ] README has install/usage
- [ ] LICENSE present
- [ ] No hardcoded secrets
Important:
- [ ] Type hints on public API
- [ ] CI runs tests on PRs
- [ ] Coverage > 70%
- [ ] Changelog maintained
Recommended:
- [ ] src/ layout
- [ ] py.typed marker
- [ ] Security scanning in CI
- [ ] Contributing guide
Learn More
This skill is based on the Guide to Developing High-Quality Python Libraries by Will McGinnis. The review criteria in this skill draw from all posts in the guide — see the full guide for detailed quality criteria across every dimension of library development.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: wdm0006
- Source: wdm0006/python-skills
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.