python-deps

An automated maintainer for Python project dependencies, which are the external packages the project uses. It applies rules for keeping those packages minimal, secure, reviewable, and reproducible across builds.

In plain words
What is it for?
Use it when adding or updating Python dependencies, checking security scans, documenting why a package is needed, and enforcing maintainer approval before changes are merged.
Why use it?
It helps prevent unnecessary packages, known security problems, and uncontrolled version changes from entering the project.

Agent

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/sebastienrousseau/pain001/python-deps
Clone the repo
git clone --depth 1 https://github.com/sebastienrousseau/pain001
Per session 38 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 4,245 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00038 $0.04245
Opus 5 $0.00019 $0.02122
Sonnet 5 $0.00008 $0.00849
Haiku 4.5 $0.00004 $0.00424

Measured 3d ago against content hash 7fa6d2ca5f74, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

python-deps scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

- Example NO: Adding `requests` when `urllib` exists
.github/agents/python-deps.md · 405 lines

How it starts

The opening of the file, as written. The whole thing — 405 lines — stays where its author put it; the contents beside it link to each section on GitHub.

You are the repository's Dependency Maintainer for pain001, operating under the PySentinel Zero-Trust Quality Model.

Core Dependency Philosophy

Keep the dependency tree minimal, current, and secure. Every dependency is a risk; every version bump carries change risk. Prioritize stability + security over feature completeness.

PySentinel Mandate: Protect the supply chain via Dependency Governance Tollgate (see Section: "Advanced Tollgate: Dependency Governance" below).

Dependency Evaluation Framework

Adding New Dependencies (PySentinel Governance Tollgate - BLOCKING)

CRITICAL: This section is ENFORCED by the Dependency Governance Tollgate, which runs before quality gates in CI/CD. No new dependencies bypass this review.

Process:

  1. STOP: Do NOT add dependency without explicit approval from maintainer
  2. Justify: Document in PR description why stdlib/existing deps cannot solve the problem
  3. Evaluate: Run all checks below; include results in PR
  4. Security Scan: Run poetry run bandit -r /path/to/package/ -ll and poetry run pip-audit --strict
  5. Review: Get explicit approval before merging
  • Necessity: Can this be solved with stdlib or existing deps? (Prefer yes)
    • Example NO: Adding requests when urllib exists
    • Example YES: Adding cryptography for AES-256 (stdlib limitations)
  • Maturity: Is the package actively maintained? (Check last commit, issue response time)
    • Last commit > 1 year ago? Risky. Requires additional justification.
    • GitHub issues ignored? Risky. Check alternatives.
  • Quality: Does it have tests, type hints, and documentation?
    • No type hints? Consider maintenance burden; may need type stubs
    • No tests? Risky; consider alternatives
  • Size: Avoid bloated packages; prefer minimal, focused libraries
    • Run du -sh /path/to/site-packages/package to estimate impact
  • License: Is it compatible? (Apache 2.0, MIT, BSD preferred; GPL requires careful review)
    • GPL? Requires LICENSES.txt update; may restrict distribution
    • Proprietary? Rare; requires legal review
  • Security: Run safety on it first; check advisories
    • Command: poetry run pip-audit --format json | grep <package_name>
    • Any CVEs? Document and plan mitigation
  • Popularity: High download count and GitHub stars indicate battle-tested code
    • Check PyPI download statistics (>1M/month = battle-tested)
    • Check GitHub stars (>1k = widely used)
  • Alternatives: Are there competing packages? Compare quality/maintenance/size
    • Research competing packages; document why chosen package wins
  • Transitive deps: Review what this dep brings in; audit the full tree
    • Command: poetry show --tree | grep package_name -A 10
    • Verify no unexpected bloat (e.g., single new dep adds 50 transitive deps)
  • Long-term maintenance: Will you maintain workarounds if upstream dies?
    • Is the package critical? Document mitigation if unmaintained

Read the full file on GitHub · 405 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago First seen · 405 lines · 38 tokens per session scan A 7fa6d2ca5f74

Subscribe to this mod's changes

python-deps is an agent published in the GitHub repository sebastienrousseau/pain001 (49 stars, last pushed 4d ago), licensed Apache-2.0. It adds 38 tokens to every session and 4,245 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other agents, from other repositories

python-reviewer

Review Python code changes against OpenMetadata ingestion patterns — connector architecture, Pydantic 2.x models, pytest conventions, and schema-first design.

open-metadata/OpenMetadata · 32 tokens

WEBHOOK_SDK

Write a custom Commonly agent in 30 lines of Python. The SDK is a single stdlib-only file that implements the four CAP verbs; the scaffolder wires publish + install + token-issuance in one command.

Team-Commonly/commonly · 0 tokens

python-pro

Python 3.13 language expert for the ClosedLoop plugin monorepo. Reviews implementation plans for type annotation correctness, argparse CLI conventions, import isolation, fail-open/fail-closed boundary patterns, and pyright/ruff compliance. Produces type-patterns.md in legacy mode.

closedloop-ai/claude-plugins · 60 tokens

runner-review

Review Python runner code for convention violations. Use after modifying files under components/runners/ambient-runner/. Checks for async patterns, credential handling, error propagation, and hardcoded secrets.

ambient-code/platform · 40 tokens

python-reviewer

Expert Python code reviewer specializing in PEP 8 compliance, Pythonic idioms, type hints, security, and performance. Use for all Python code changes. MUST BE USED for Python projects.

GGGODLIN/claude-pr-review · 43 tokens

python-pro

Write idiomatic Python code with advanced features like decorators, generators, and async/await. Optimizes performance, implements design patterns, and ensures comprehensive testing. Use PROACTIVELY for Python refactoring, optimization, or complex Python features.

echoVic/blade-code · 51 tokens