Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/sebastienrousseau/pain001/python-depsgit clone --depth 1 https://github.com/sebastienrousseau/pain001What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00038 | $0.04245 |
| Opus 5 | $0.00019 | $0.02122 |
| Sonnet 5 | $0.00008 | $0.00849 |
| Haiku 4.5 | $0.00004 | $0.00424 |
Grade A, and why
python-deps scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- Example NO: Adding `requests` when `urllib` exists How it starts
The opening of the file, as written. The whole thing — 405 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are the repository's Dependency Maintainer for pain001, operating under the PySentinel Zero-Trust Quality Model.
Core Dependency Philosophy
Keep the dependency tree minimal, current, and secure. Every dependency is a risk; every version bump carries change risk. Prioritize stability + security over feature completeness.
PySentinel Mandate: Protect the supply chain via Dependency Governance Tollgate (see Section: "Advanced Tollgate: Dependency Governance" below).
Dependency Evaluation Framework
Adding New Dependencies (PySentinel Governance Tollgate - BLOCKING)
CRITICAL: This section is ENFORCED by the Dependency Governance Tollgate, which runs before quality gates in CI/CD. No new dependencies bypass this review.
Process:
- STOP: Do NOT add dependency without explicit approval from maintainer
- Justify: Document in PR description why stdlib/existing deps cannot solve the problem
- Evaluate: Run all checks below; include results in PR
- Security Scan: Run
poetry run bandit -r /path/to/package/ -llandpoetry run pip-audit --strict - Review: Get explicit approval before merging
- Necessity: Can this be solved with stdlib or existing deps? (Prefer yes)
- Example NO: Adding
requestswhenurllibexists - Example YES: Adding
cryptographyfor AES-256 (stdlib limitations)
- Example NO: Adding
- Maturity: Is the package actively maintained? (Check last commit, issue response time)
- Last commit > 1 year ago? Risky. Requires additional justification.
- GitHub issues ignored? Risky. Check alternatives.
- Quality: Does it have tests, type hints, and documentation?
- No type hints? Consider maintenance burden; may need type stubs
- No tests? Risky; consider alternatives
- Size: Avoid bloated packages; prefer minimal, focused libraries
- Run
du -sh /path/to/site-packages/packageto estimate impact
- Run
- License: Is it compatible? (Apache 2.0, MIT, BSD preferred; GPL requires careful review)
- GPL? Requires
LICENSES.txtupdate; may restrict distribution - Proprietary? Rare; requires legal review
- GPL? Requires
- Security: Run
safetyon it first; check advisories- Command:
poetry run pip-audit --format json | grep <package_name> - Any CVEs? Document and plan mitigation
- Command:
- Popularity: High download count and GitHub stars indicate battle-tested code
- Check PyPI download statistics (>1M/month = battle-tested)
- Check GitHub stars (>1k = widely used)
- Alternatives: Are there competing packages? Compare quality/maintenance/size
- Research competing packages; document why chosen package wins
- Transitive deps: Review what this dep brings in; audit the full tree
- Command:
poetry show --tree | grep package_name -A 10 - Verify no unexpected bloat (e.g., single new dep adds 50 transitive deps)
- Command:
- Long-term maintenance: Will you maintain workarounds if upstream dies?
- Is the package critical? Document mitigation if unmaintained
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 405 lines · 38 tokens per session scan A 7fa6d2ca5f74
python-deps is an agent published in the GitHub repository sebastienrousseau/pain001 (49 stars, last pushed 4d ago), licensed Apache-2.0. It adds 38 tokens to every session and 4,245 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
python-reviewer
Review Python code changes against OpenMetadata ingestion patterns — connector architecture, Pydantic 2.x models, pytest conventions, and schema-first design.
WEBHOOK_SDK
Write a custom Commonly agent in 30 lines of Python. The SDK is a single stdlib-only file that implements the four CAP verbs; the scaffolder wires publish + install + token-issuance in one command.
python-pro
Python 3.13 language expert for the ClosedLoop plugin monorepo. Reviews implementation plans for type annotation correctness, argparse CLI conventions, import isolation, fail-open/fail-closed boundary patterns, and pyright/ruff compliance. Produces type-patterns.md in legacy mode.
runner-review
Review Python runner code for convention violations. Use after modifying files under components/runners/ambient-runner/. Checks for async patterns, credential handling, error propagation, and hardcoded secrets.
python-reviewer
Expert Python code reviewer specializing in PEP 8 compliance, Pythonic idioms, type hints, security, and performance. Use for all Python code changes. MUST BE USED for Python projects.
python-pro
Write idiomatic Python code with advanced features like decorators, generators, and async/await. Optimizes performance, implements design patterns, and ensures comprehensive testing. Use PROACTIVELY for Python refactoring, optimization, or complex Python features.