Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/sordi-ai/skill-everything/pythongit clone --depth 1 https://github.com/sordi-ai/skill-everythingWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00022 | $0.02180 |
| Opus 5 | $0.00011 | $0.01090 |
| Sonnet 5 | $0.00004 | $0.00436 |
| Haiku 4.5 | $0.00002 | $0.00218 |
Grade A, and why
python scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 206 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Sub-Skill: Python Best Practices
Purpose: Prevents the Python-specific mistakes LLMs make on autopilot — mutable defaults, bare excepts, missing guards, and subtle performance traps that pass review but break in production.
Rule classification
- MUST — load-bearing. Violating causes bugs, security issues, or invisible failures. Never break.
- SHOULD — default behavior. Deviation needs a documented reason in the code or PR.
- AVOID — usually wrong; documented exception inline where needed.
Where these rules don't strictly apply: test fixtures, generated code, throwaway scripts, REPL exploration, and tutorial snippets may legitimately differ. The rules below apply to production code paths and reusable libraries.
Rules
Type Hints
-
SHOULD: Annotate function signatures with types.
def process(data)tells callers nothing. Usedef process(data: list[str]) -> dict[str, int]:. Return typeNoneshould be explicit too. Exception: lambdas and short generator helpers in private scope. -
SHOULD: Use built-in lowercase generics for Python 3.9+.
list[str],dict[str, int],tuple[int, ...]rather thanList,Dict,Tuplefromtyping. -
MUST: Use
Optional[X]orX | Nonefor nullable parameters, never a bare default ofNonewithout a type annotation.def find(id: int) -> User | None:notdef find(id):. -
AVOID:
Anyas a shortcut. If the type is genuinely unknown, document why with a comment.Anysilences the type checker and hides bugs. Exception: third-party libraries without stubs and explicit dynamic-data boundaries (e.g. JSON decode at the API edge).
Error Handling
-
MUST: Never use bare
except:. It catchesSystemExit,KeyboardInterrupt, andGeneratorExit. Always catchexcept Exception:at minimum, or a specific exception class.# Wrong try: risky() except: pass # Correct try: risky() except ValueError as e: logger.warning("Invalid value: %s", e)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 206 lines · 22 tokens per session scan A e6f4160511d8
python is a cursor rule published in the GitHub repository sordi-ai/skill-everything (19 stars, last pushed 3mo ago), licensed MIT. It adds 22 tokens to every session and 2,180 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other cursor rules, from other repositories
00-stack
Stack, runtimes, and MCP servers for this repository.
20-testing
How to run tests and MCP smoke checks.
30-security
Secrets, gitleaks, age encryption, telemetry redaction.
obsidian-memory
Markdown vault memory protocol (vkm-kit).
10-style
Style conventions and contribution hygiene.
retention-predictor
Skill — retention-predictor. Predicts retention potential via usage frequency, habit formation mechanics, and churn risk factors.