modern-python

An agent skill by trailofbits, from trailofbits/skills. Tags: automation, cli, code-quality, developer-tools, python.

What it does

Configures Python projects with modern tooling (uv, ruff, ty). Use when creating projects, writing standalone scripts, or migrating from pip/Poetry/mypy/black.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add trailofbits/skills --skill modern-python

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/modern-python/skills/modern-python ~/.claude/skills/modern-python

Safety box score

Grade D, elevated risk: 51 of 100 risk points, rated 2026-09-22. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a documentation-only Python setup/migration kit, but it directs the agent to install tooling, fetch packages and hook repos from the network, and clean up local environments. The main risks are remote-code execution via shell-piped installers and broad local changes such as deleting virtualenvs and cache directories.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	3 (high)	It explicitly recommends executing downloaded installers and remote tools, including `curl ... \| sh`, `powershell ... \| iex`, and `uvx cookiecutter gh:trailofbits/cookiecutter-python` in `references/uv-commands.md` and `references/security-setup.md`.
Network access	2 (moderate)	The workflow repeatedly fetches code and packages from external hosts (`curl`, `uv add`, `uv sync`, GitHub `repo:` hooks, and `uvx cookiecutter ...`), so it depends on live network access and third-party registries.
Filesystem reach	2 (moderate)	Migration steps delete local state outside the repo, including `venv/`, `.venv/`, and `rm -rf ~/.cache/pre-commit` in `references/migration-checklist.md` and `references/prek.md`.
Secrets & credentials	1 (low)	It introduces secret-scanning workflows like `detect-secrets scan > .secrets.baseline` and `cat .secrets.baseline`, which inspect secret-bearing files but do not ask for or exfiltrate credentials.
Privilege & persistence	2 (moderate)	It recommends system- or user-level installs such as `brew install uv`, `brew install prek`, `cargo install prek`, and `uv tool install ...`, which modify the user's toolchain beyond the project.
Instruction hijack surface	0 (none)	No prompt-injection content, hidden instructions, or attempts to override the agent's rules are present; the text is ordinary tooling guidance.
Irreversible actions	1 (low)	The skill mentions external actions like `uv publish` and Dependabot, but it does not instruct the agent to publish, deploy, message, or delete anything autonomously.
Transparency	2 (moderate)	Some executed content is not visible in the repo itself, notably `curl ... \| sh`, `uvx cookiecutter gh:...`, and `<latest>` hook placeholders in `templates/pre-commit-config.yaml`.

Before installing

Replace every `<latest>` placeholder in `templates/pre-commit-config.yaml` with pinned tags or SHAs.
Review `references/uv-commands.md` and `references/security-setup.md` before running any `curl | sh` or similar installer.
Decide up front whether deleting `venv/`, `.venv/`, and `~/.cache/pre-commit` is acceptable for this machine.
Try the setup in a scratch repo or test account first, especially before generating `.secrets.baseline` or using `uvx cookiecutter`.

Rated 2026-09-22 by an automated review of 14 files from the skill's repository.

Source

Repository: trailofbits/skills (all skills from this repository)
Path: plugins/modern-python/skills/modern-python/SKILL.md
Branch: main
Collection: modern-python
Updated: 2026-09-19

code-improver — Runs an autonomous review-and-fix improvement loop over any code target — a skill, plugin, module, or directory — using a reviewer the user names.
dwarf-expert — Analyzes DWARF debug information in compiled binaries.
modern-cpp — Guides C++ code toward modern idioms (C++20/23/26). Use when writing new C++ code, modernizing legacy patterns, or working on security-critical C++.
pr-improver — Runs an autonomous review-and-fix improvement loop over the current branch's changes until a PR review comes back clean.
skill-improver — Runs an autonomous review-and-fix improvement loop over a Claude Code skill until a review comes back clean, with a cross-round findings ledger.
slicing-code-context — Selects bounded, graph-informed source slices with Trailmark and delegates focused code analysis or patch-proposal work to a smaller subagent.