Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/itamarzand88/awesome-agent-conventions/pythongit clone --depth 1 https://github.com/ItamarZand88/awesome-agent-conventionsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00765 | $0.00765 |
| Opus 5 | $0.00382 | $0.00382 |
| Sonnet 5 | $0.00153 | $0.00153 |
| Haiku 4.5 | $0.00076 | $0.00076 |
Grade A, and why
python scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
94% identical to python-coding — 5 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 122 lines — stays where its author put it; the contents beside it link to each section on GitHub.
description: "Python best practices and patterns for modern software development with Flask and SQLite" globs: /*.py, src//.py, tests/**/.py alwaysApply: false
Python Best Practices
Project Structure
- Use src-layout with
src/your_package_name/ - Place tests in
tests/directory parallel tosrc/ - Keep configuration in
config/or as environment variables - Store requirements in
requirements.txtorpyproject.toml - Place static files in
static/directory - Use
templates/for Jinja2 templates
Code Style
- Follow Black code formatting
- Use isort for import sorting
- Follow PEP 8 naming conventions:
- snake_case for functions and variables
- PascalCase for classes
- UPPER_CASE for constants
- Maximum line length of 88 characters (Black default)
- Use absolute imports over relative imports
Type Hints
- Use type hints for all function parameters and returns
- Import types from
typingmodule - Use
Optional[Type]instead ofType | None - Use
TypeVarfor generic types - Define custom types in
types.py - Use
Protocolfor duck typing
Flask Structure
- Use Flask factory pattern
- Organize routes using Blueprints
- Use Flask-SQLAlchemy for database
- Implement proper error handlers
- Use Flask-Login for authentication
- Structure views with proper separation of concerns
Database
- Use SQLAlchemy ORM
- Implement database migrations with Alembic
- Use proper connection pooling
- Define models in separate modules
- Implement proper relationships
- Use proper indexing strategies
Authentication
- Use Flask-Login for session management
- Implement Google OAuth using Flask-OAuth
- Hash passwords with bcrypt
- Use proper session security
- Implement CSRF protection
- Use proper role-based access control
API Design
- Use Flask-RESTful for REST APIs
- Implement proper request validation
- Use proper HTTP status codes
- Handle errors consistently
- Use proper response formats
- Implement proper rate limiting
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 122 lines · 765 tokens per session scan A dca817c4a670
python is a cursor rule published in the GitHub repository ItamarZand88/awesome-agent-conventions (29 stars, last pushed 1mo ago), licensed MIT. It adds 765 tokens to every session, about $0.0038 per session on Opus 5. A static security scan graded it A with 0 findings. It is 94% identical to python-coding, differing in 5 lines, and is treated as a copy.
Other cursor rules, from other repositories
digital-death-plan
Plan what happens to your digital life when you die — accounts, photos, passwords, money, and social profiles — so someone you trust can actually find, access, memorialize, or close them without a legal nightmare. Use when someone says 'what happens to my accounts when I die', 'digital legacy', 'help my family access…
grief-admin
Get through the brutal logistics after a death — who to notify, what accounts and services to close, in what order, and what genuinely can't wait vs what can wait months — with explicit permission to do it slowly and in pieces. Use when someone says 'my [person] died and I don't know where to start', 'what do I need…
mechanic-quote-decoder
Read a garage quote or invoice like someone who can't be padded — which line items connect to your actual symptom, which are while-we're-in-there additions, the questions that make soft lines disappear, when a second opinion pays for itself, and the scripts for declining work without souring the relationship. Use when…
used-car-decoder
Decode a used-car listing before you drive an hour to see it — what the seller's phrasing is hiding, the history-check items that matter, a test-drive and inspection checklist ordered by cost-of-miss, the questions that make evasive sellers visible, and the walk-away signs ranked 🔴🟡🟢. Use when someone says 'is this…
life-premortem
Write the failure story of your year, relationship, move, or big life bet in advance — imagine it's a year later and it went wrong, tell that story vividly, then mine it for the real risks and the cheap things that would have prevented them. Use when someone says 'I'm about to make a big life change', 'what could go…
api-for-yourself
Publish 'how to work with me' as a literal API spec — endpoints (what to ask me for and what you'll get back), rate limits (meeting and interrupt tolerance), error codes (what happens when you surprise me Friday 5pm), auth (how to earn trust), and a changelog. Use when onboarding to a new team, when a new manager or…