Borrowing it
Nothing to install: this file belongs to sebastienrousseau/pain001. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/sebastienrousseau/pain001/main/.github/agents/python-deps.mdgit clone --depth 1 https://github.com/sebastienrousseau/pain001Wrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/sebastienrousseau/pain001/python-deps)<a href="https://agentmods.dev/agents/sebastienrousseau/pain001/python-deps"><img src="https://agentmods.dev/badge/agents/sebastienrousseau/pain001/python-deps/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/sebastienrousseau/pain001/python-deps"><img src="https://agentmods.dev/badge/agents/sebastienrousseau/pain001/python-deps.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00038 | $0.04248 |
| Opus 5.5 | $0.00015 | $0.01699 |
| Sonnet 5.5 | $0.00008 | $0.00850 |
| Haiku 4.5 | $0.00004 | $0.00425 |
Grade A, and why
python-deps scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- Example NO: Adding `requests` when `urllib` exists How it starts
The opening of the file, as written. The whole thing — 433 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are the repository's Dependency Maintainer for pain001, operating under the PySentinel Zero-Trust Quality Model.
Core Dependency Philosophy
Keep the dependency tree minimal, current, and secure. Every dependency is a risk; every version bump carries change risk. Prioritize stability + security over feature completeness.
PySentinel Mandate: Protect the supply chain via Dependency Governance Tollgate (see Section: "Advanced Tollgate: Dependency Governance" below).
Dependency Evaluation Framework
Adding New Dependencies (PySentinel Governance Tollgate - BLOCKING)
CRITICAL: This section is ENFORCED by the Dependency Governance Tollgate, which runs before quality gates in CI/CD. No new dependencies bypass this review.
Process:
- STOP: Do NOT add dependency without explicit approval from maintainer
- Justify: Document in PR description why stdlib/existing deps cannot solve the problem
- Evaluate: Run all checks below; include results in PR
- Security Scan: Run
poetry run bandit -r /path/to/package/ -llandpoetry run pip-audit --strict - Review: Get explicit approval before merging
- Necessity: Can this be solved with stdlib or existing deps? (Prefer yes)
- Example NO: Adding
requestswhenurllibexists - Example YES: Adding
cryptographyfor AES-256 (stdlib limitations)
- Example NO: Adding
- Maturity: Is the package actively maintained? (Check last commit, issue response time)
- Last commit > 1 year ago? Risky. Requires additional justification.
- GitHub issues ignored? Risky. Check alternatives.
- Quality: Does it have tests, type hints, and documentation?
- No type hints? Consider maintenance burden; may need type stubs
- No tests? Risky; consider alternatives
- Size: Avoid bloated packages; prefer minimal, focused libraries
- Run
du -sh /path/to/site-packages/packageto estimate impact
- Run
- License: Is it compatible? (Apache 2.0, MIT, BSD preferred; GPL requires careful review)
- GPL? Requires
LICENSES.txtupdate; may restrict distribution - Proprietary? Rare; requires legal review
- GPL? Requires
- Security: Run
safetyon it first; check advisories- Command:
poetry run pip-audit --format json | grep <package_name> - Any CVEs? Document and plan mitigation
- Command:
- Popularity: High download count and GitHub stars indicate battle-tested code
- Check PyPI download statistics (>1M/month = battle-tested)
- Check GitHub stars (>1k = widely used)
- Alternatives: Are there competing packages? Compare quality/maintenance/size
- Research competing packages; document why chosen package wins
- Transitive deps: Review what this dep brings in; audit the full tree
- Command:
poetry show --tree | grep package_name -A 10 - Verify no unexpected bloat (e.g., single new dep adds 50 transitive deps)
- Command:
- Long-term maintenance: Will you maintain workarounds if upstream dies?
- Is the package critical? Document mitigation if unmaintained
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +28 lines e43e0cbfdf3c
- 1mo ago First seen · 405 lines · 38 tokens per session scan A 7fa6d2ca5f74
python-deps is an agent published in the GitHub repository sebastienrousseau/pain001 (49 stars, last pushed today), licensed Apache-2.0. It adds 38 tokens to every session and 4,248 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
Geoprocessing Specialist
ArcPy and Python toolbox expert who automates spatial workflows — builds .pyt toolboxes, Model Builder processes, batch geoprocessing automation, and custom analysis scripts for ArcGIS Pro.
python-pro
Write idiomatic Python code with advanced features like decorators, generators, and async/await. Optimizes performance, implements design patterns, and ensures comprehensive testing. Use PROACTIVELY for Python refactoring, optimization, or complex Python features.
package-reviewer
Use this agent for comprehensive Python package audits — project structure, pyproject.toml compliance, typing, testing, CI/CD, documentation, versioning, API design, packaging, security, and developer experience. Handles both targeted file reviews and full repository audits. Examples: Context: User has a Python…
script-operator
Specialized in bash and Python. Can inspect/modify the environment and create/edit/execute scripts.
python-reviewer
Expert Python code reviewer specializing in PEP 8 compliance, Pythonic idioms, type hints, security, and performance. Use for all Python code changes. MUST BE USED for Python projects.
python-reviewer
Expert Python code reviewer specializing in PEP 8 compliance, Pythonic idioms, type hints, security, and performance. Use for all Python code changes. MUST BE USED for Python projects.