python

Coding rules for Python projects, including project layout, naming, formatting, type annotations, and Flask application structure. Flask is a Python web framework, and SQLite is a small file-based database.

In plain words
What is it for?
Use them when writing or reviewing Python, Flask, SQLite, and test code in files matched by the rules.
Why use it?
They give the agent consistent conventions so Python code, tests, imports, and Flask files are easier to maintain.

Cursor rule

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add rules/itamarzand88/awesome-agent-conventions/python
Clone the repo
git clone --depth 1 https://github.com/ItamarZand88/awesome-agent-conventions
Per session 765 This file is loaded in full into every session.
When invoked 765 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin 94% copy Near-identical to another mod in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00765 $0.00765
Opus 5 $0.00382 $0.00382
Sonnet 5 $0.00153 $0.00153
Haiku 4.5 $0.00076 $0.00076

Measured 2d ago against content hash dca817c4a670, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

python scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

This is a copy

94% identical to python-coding — 5 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.

conventions/agent-rules/examples/awesome-cursorrules-python/python.mdc · 122 lines

How it starts

The opening of the file, as written. The whole thing — 122 lines — stays where its author put it; the contents beside it link to each section on GitHub.


description: "Python best practices and patterns for modern software development with Flask and SQLite" globs: /*.py, src//.py, tests/**/.py alwaysApply: false

Python Best Practices

Project Structure

  • Use src-layout with src/your_package_name/
  • Place tests in tests/ directory parallel to src/
  • Keep configuration in config/ or as environment variables
  • Store requirements in requirements.txt or pyproject.toml
  • Place static files in static/ directory
  • Use templates/ for Jinja2 templates

Code Style

  • Follow Black code formatting
  • Use isort for import sorting
  • Follow PEP 8 naming conventions:
    • snake_case for functions and variables
    • PascalCase for classes
    • UPPER_CASE for constants
  • Maximum line length of 88 characters (Black default)
  • Use absolute imports over relative imports

Type Hints

  • Use type hints for all function parameters and returns
  • Import types from typing module
  • Use Optional[Type] instead of Type | None
  • Use TypeVar for generic types
  • Define custom types in types.py
  • Use Protocol for duck typing

Flask Structure

  • Use Flask factory pattern
  • Organize routes using Blueprints
  • Use Flask-SQLAlchemy for database
  • Implement proper error handlers
  • Use Flask-Login for authentication
  • Structure views with proper separation of concerns

Database

  • Use SQLAlchemy ORM
  • Implement database migrations with Alembic
  • Use proper connection pooling
  • Define models in separate modules
  • Implement proper relationships
  • Use proper indexing strategies

Authentication

  • Use Flask-Login for session management
  • Implement Google OAuth using Flask-OAuth
  • Hash passwords with bcrypt
  • Use proper session security
  • Implement CSRF protection
  • Use proper role-based access control

API Design

  • Use Flask-RESTful for REST APIs
  • Implement proper request validation
  • Use proper HTTP status codes
  • Handle errors consistently
  • Use proper response formats
  • Implement proper rate limiting

Read the full file on GitHub · 122 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 122 lines · 765 tokens per session scan A dca817c4a670

Subscribe to this mod's changes

python is a cursor rule published in the GitHub repository ItamarZand88/awesome-agent-conventions (29 stars, last pushed 1mo ago), licensed MIT. It adds 765 tokens to every session, about $0.0038 per session on Opus 5. A static security scan graded it A with 0 findings. It is 94% identical to python-coding, differing in 5 lines, and is treated as a copy.

Related

Other cursor rules, from other repositories

digital-death-plan

Plan what happens to your digital life when you die — accounts, photos, passwords, money, and social profiles — so someone you trust can actually find, access, memorialize, or close them without a legal nightmare. Use when someone says 'what happens to my accounts when I die', 'digital legacy', 'help my family access…

mohitagw15856/pm-claude-skills · 116 tokens

grief-admin

Get through the brutal logistics after a death — who to notify, what accounts and services to close, in what order, and what genuinely can't wait vs what can wait months — with explicit permission to do it slowly and in pieces. Use when someone says 'my [person] died and I don't know where to start', 'what do I need…

mohitagw15856/pm-claude-skills · 130 tokens

mechanic-quote-decoder

Read a garage quote or invoice like someone who can't be padded — which line items connect to your actual symptom, which are while-we're-in-there additions, the questions that make soft lines disappear, when a second opinion pays for itself, and the scripts for declining work without souring the relationship. Use when…

mohitagw15856/pm-claude-skills · 129 tokens

used-car-decoder

Decode a used-car listing before you drive an hour to see it — what the seller's phrasing is hiding, the history-check items that matter, a test-drive and inspection checklist ordered by cost-of-miss, the questions that make evasive sellers visible, and the walk-away signs ranked 🔴🟡🟢. Use when someone says 'is this…

mohitagw15856/pm-claude-skills · 129 tokens

life-premortem

Write the failure story of your year, relationship, move, or big life bet in advance — imagine it's a year later and it went wrong, tell that story vividly, then mine it for the real risks and the cheap things that would have prevented them. Use when someone says 'I'm about to make a big life change', 'what could go…

mohitagw15856/pm-claude-skills · 121 tokens

api-for-yourself

Publish 'how to work with me' as a literal API spec — endpoints (what to ask me for and what you'll get back), rate limits (meeting and interrupt tolerance), error codes (what happens when you surprise me Friday 5pm), auth (how to earn trust), and a changelog. Use when onboarding to a new team, when a new manager or…

mohitagw15856/pm-claude-skills · 112 tokens