stack-onboarding-python — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited stack-onboarding-python (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Per-stack reference for the base variant. Companion to agents/onboarding/idiom-advisor.md — this skill is the deeper reference; the advisor is the orienting card.
| Concern | Recommendation |
|---|---|
| Test runner | pytest (preferred) or unittest (stdlib) |
| Package manager | uv (preferred for new) or pip (universal) |
| Build tool | hatch build (PEP 517) or python -m build |
| Type checker | mypy --strict or pyright |
| Linter | ruff check (fast; replaces flake8 + isort + many pylint checks) |
| Formatter | ruff format (replaces black with same defaults) |
| Min Python | 3.10+ for new projects (PEP 604 union syntax, match statement, type-hints UX) |
pytest # all tests under cwd
pytest -xvs # stop on first fail; verbose; capture off
pytest tests/test_foo.py::TestClass # single class
pytest -k "name_substring" # name filter
pytest --collect-only -q # inventory without running
pytest -n auto # parallel (requires pytest-xdist)
pytest --cov=src --cov-report=term # coverage (requires pytest-cov)import pytest
@pytest.fixture
def db_session():
s = make_session()
yield s
s.close()
@pytest.mark.parametrize("inp,expected", [
("foo", 3),
("bar", 3),
("baz", 3),
])
def test_len(inp, expected):
assert len(inp) == expectedconftest.py is auto-discovered by pytest; put shared fixtures there. Custom markers go in pyproject.toml::[tool.pytest.ini_options].markers.
uv venv # create .venv
uv pip install -e . # editable install of current project
uv pip install pytest mypy ruff # add deps
uv lock # write uv.lock
uv sync # install per uv.lock (reproducible)python -m venv .venv && source .venv/bin/activate
pip install -e .
pip install pytest mypy ruff
pip freeze > requirements.txt # NOT ideal — use pip-tools for proper locking[project]
name = "myproject"
version = "0.1.0"
requires-python = ">=3.10"
dependencies = ["httpx>=0.27", "pydantic>=2.0"]
[project.optional-dependencies]
dev = ["pytest>=8", "mypy>=1.10", "ruff>=0.5"]
[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"hatch build # builds sdist + wheel under dist/
python -m build # alternative; same outputs
twine upload dist/* # publish to PyPI (after build)mypy --strict src/--strict enables: no untyped defs, no implicit Optional, warn on unused # type: ignore, etc. Pin versions; mypy releases occasionally tighten checks.
ruff check src/ # lint
ruff check --fix src/ # autofix
ruff format src/ # format (replaces black)pyproject.toml::[tool.ruff] to configure rules.
def f(x=[]) — the list is shared across all calls. Use def f(x=None): x = x or [].KeyboardInterrupt and SystemExit. Use except Exception: (and per rules/zero-tolerance.md Rule 3, NOT except: pass).exec(user_input) — arbitrary code execution. Per rules/security.md, BLOCKED.__init__.py is still safer for libraries.logger.info(f"got {x}") evaluates eagerly even when log level disables. Prefer logger.info("got %s", x).from dataclasses import dataclass
@dataclass(frozen=True)
class Point:
x: float
y: floatfrozen=True makes instances hashable and prevents accidental mutation. kw_only=True (3.10+) enforces keyword-only construction.
from contextlib import contextmanager
@contextmanager
def open_session():
s = make_session()
try:
yield s
finally:
s.close()
with open_session() as s:
s.query(...)def read_lines(path):
with open(path) as f:
for line in f:
yield line.rstrip()Memory-efficient — no list materialization. Compose with itertools.islice, map, filter.
from __future__ import annotationsfrom __future__ import annotations
from typing import TYPE_CHECKING
if TYPE_CHECKING:
from .other_module import OtherClass
def f(x: OtherClass) -> int: ...Lazy evaluation of annotations; supports forward refs without quotes; reduces import overhead.
from pydantic import BaseModel, Field
class CreateUser(BaseModel):
email: str = Field(..., min_length=3, max_length=120)
name: str
age: int = Field(..., ge=0, le=150)Pydantic v2 is fast (Rust-backed) and has the best-in-class JSON-schema support.
pytest --collect-only -q to inventory tests; mypy --strict to surface type-graph issues; ruff check to flag lint violations across the surface.src/<pkg>/); each shard ≤500 LOC load-bearing logic per rules/autonomous-execution.md.pytest -x per shard (fail-fast); mypy --strict on the shard's package; commit cadence per rules/git.md.mypy --strict, ruff check, pytest --collect-only -q (zero-error exit), pip check (no version conflicts).frozen=True dataclass for X"); per rules/agent-reasoning.md, agent-routing logic stays LLM-first.hatch build; verify dist/*.whl and dist/*.tar.gz; twine check dist/* before upload; __version__ and pyproject.toml::version updated atomically per rules/zero-tolerance.md Rule 5.agents/generic/db-specialist.md — for Python DB drivers (psycopg, asyncpg, sqlalchemy)agents/generic/api-specialist.md — for Python HTTP frameworks (FastAPI, Flask, Django)agents/generic/ai-specialist.md — for Python LLM SDKs (openai, anthropic, litellm)Deepen with: async patterns (asyncio + aiohttp + asyncpg); packaging for distribution (sdist vs wheel; cross-platform wheels via cibuildwheel); profiling (cProfile, py-spy).
Origin: 2026-05-06 v2.21.0 base-variant Phase 1 STARTER.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.