coding-guidance-python — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited coding-guidance-python (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill adds portable Python implementation, refactoring, and review guidance.
This skill provides portable Python engineering principles. Compose with:
recursive-thinking (stress-testing), security (threat modeling)
backend-systems-guidance (stronger backend architecture, reliability, and trust-boundary work), ui-guidance (graphical UI/web frontend), project-core-dev (repo-specific completion discovery and reporting when needed)
Open bundled references only when the task needs that depth:
for typing, interface, test, data-state, module, and architecture decisions
for distribution, entrypoint, import-layout, or package-structure work
for async cancellation, subprocesses, workers, and real external I/O or service boundaries
not the main concern
Python standards
docs before editing.
request is only partially specified. Ask only when multiple plausible designs would change semantics.
handling, and public API shape explicit.
where they improve the contract, and production-safe behavior at I/O boundaries.
framework and conventions. Use fixtures or parameterization when they make setup and cases clearer rather than merely shorter.
and test targets the repo supports.
Use this instead of the default implementation workflow when the task is primarily cleanup or restructuring:
mutation hotspots.
anti-patterns one step at a time.
when behavior is unclear.
operate.
When reviewing (not implementing), skip the implementation workflow and use this instead:
Critical > Important >Suggestion.
shared-state mistakes, typing and interface mismatches, packaging or import breakage, performance mistakes with real impact, security risks, and missing tests. Add service-boundary observability, retry, and timeout findings when the change actually crosses a real external boundary.
Do not edit code or require findings to be fixed unless the user also asks for remediation.
mutation, or heavy initialization unless the module is explicitly an entrypoint
context, or mutation of module-level state
None handling, optional fields, and missing keys as contract design,not cleanup for callers to guess
failure without adding useful domain context
with lifetime rules
datetimes, and sync vs. async call paths
indirection; introduce abstractions only when they clarify a real state or behavior boundary.
types where they clarify public or non-trivial contracts, and keep Any as an explicit escape hatch rather than a default.
migrate unittest to pytest merely because new tests are needed.
integration coverage when a change crosses package, transport, persistence, or subprocess seams.
replace long-lived dict-shaped data or hidden mutation with named contracts.
transport, persistence, and domain logic testable at their own seams.
cancellation, and protect shared invariants rather than individual fields.
when the task crosses a real external boundary.
Load the references above for the detailed language, testing, packaging, async, subprocess, and service-boundary rules.
Use these when the right choice is not obvious:
import contracts, stop and plan the compatibility and dependency effects before continuing.
function signature, redesign the interface or add a one-line contract comment.
Any, untyped dicts, or loose tuples start spreading,introduce a clearer type boundary before adding more code.
explicitly and keep adaptation local.
layout, or published metadata, treat that as a compatibility boundary rather than a refactor detail.
or degrade, make the ownership and diagnostics explicit; local helper code usually does not need the same instrumentation.
or framework conventions, follow them unless they create a correctness or maintainability problem.
problem. When narrowness conflicts with correctness or clarity, prefer correctness. When it conflicts with style alone, prefer narrowness unless the task is explicitly a cleanup.
for the requested change's correctness or safety; report them separately.
pain is a pattern; before extracting, check whether a helper function, named type, or boundary cleanup is the simpler move.
algorithmic, allocation, or I/O mistakes on hot paths.
ownership, or test seams, prefer the plainer construct.
in shell; if the problem needs rich data shaping, type-safe contracts, or non-trivial retry and observability logic, prefer Python over stretching shell too far.
For implementation, a change is done when:
out with a concrete reason
distributable library or CLI
For review, completion means Critical and Important findings are reported with concrete evidence, likely consequence, and any validation gap. Unfixed findings do not make the review incomplete.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.