A release skill for publishing Python packages to PyPI, the main public package registry for Python. It focuses on GitHub Actions publishing through OIDC Trusted Publishing and signed package attestations instead of long-lived tokens.

Use it to prepare and publish a package, troubleshoot publisher errors, run publishing preflight checks, and configure an OIDC-based GitHub Actions workflow.

It reduces the risk of leaked publishing credentials and helps diagnose registry, first-publish, approval, and TestPyPI problems.

pypi-ops — Skill for Claude Code by 0xDarkMatter

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add 0xDarkMatter/claude-mods --skill pypi-ops

Clone the repo

git clone --depth 1 https://github.com/0xDarkMatter/claude-mods

Made for: Claude Code.

Or install claude-mods, the plugin that ships this one along with the rest of its 103 skills, 3 commands, 3 agents, 4 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/0xdarkmatter/claude-mods/pypi-ops/github.svg)](https://agentmods.dev/skills/0xdarkmatter/claude-mods/pypi-ops)

Your own site

<a href="https://agentmods.dev/skills/0xdarkmatter/claude-mods/pypi-ops"><img src="https://agentmods.dev/badge/skills/0xdarkmatter/claude-mods/pypi-ops/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/0xdarkmatter/claude-mods/pypi-ops"><img src="https://agentmods.dev/badge/skills/0xdarkmatter/claude-mods/pypi-ops.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 74 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 3,169 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector pass 7 Sept 2026

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00074	$0.03169
Opus 5	$0.00037	$0.01584
Sonnet 5	$0.00015	$0.00634
Haiku 4.5	$0.00007	$0.00317

Measured 6d ago against content hash d481bafc6ca5, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-09, from the pricing page.

Security

Grade A, and why

pypi-ops scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.

The scan reads SKILL.md. This mod also ships 4 executable files (scripts/check-action-pins.py, scripts/diagnose-publish.sh, scripts/publish-preflight.sh, …), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/pypi-ops/SKILL.md · 242 lines

How it starts

The opening of the file, as written. The whole thing — 242 lines — stays where its author put it; the contents beside it link to each section on GitHub.

PyPI Operations

Publish Python packages to PyPI on the 2026 best-practice path: OIDC Trusted Publishing with signed PEP 740 attestations, no long-lived token to leak. This skill owns the publish layer (the registry handshake, the first-publish gotchas, the recovery playbook). General GitHub Actions syntax is ci-cd-ops; the install-side worm defense is supply-chain-defense; gh/release-page mechanics are github-ops.

Where this fits — the release pipeline

A release spans several skills; pypi-ops owns the registry step. Chain them:

Vet dependencies before cutting a release — supply-chain-defense (cooldown + behavioural scan). The build runs dependency code before it touches your publish credential, so a poisoned build dep can steal the token.
Preflight — scripts/publish-preflight.sh --build . (this skill).
Bump → tag → push — git-ops (its push-gate scans for secrets / forbidden files before the tag goes up).
CI publishes via OIDC — this skill's assets/publish.yml; you approve at the pypi environment gate.
Release page (optional, GitHub) — github-ops, human-reviewed notes.

The one decision: OIDC vs API token

Default to OIDC Trusted Publishing. Reach for a token only when OIDC is impossible (publishing from a non-supported CI, or a one-off local push).

	Trusted Publishing (OIDC) ← default	API token
Secret stored	None — short-lived OIDC token minted per run	Long-lived `pypi-…` token in a secret
Leak/phish blast radius	None to steal	Full publish rights until rotated
Provenance	PEP 740 attestations (signed, verifiable)	None by default
Setup	One-time publisher registration on PyPI	Generate token + store secret
Best for	All CI/CD releases	Legacy CI, emergency local upload

If a repo currently uses a token, migrating to OIDC is strictly an upgrade — see references/trusted-publishing.md.

Read the full file on GitHub · 242 lines

Files

What ships with it

8 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

6d ago First seen · 242 lines · 74 tokens per session scan A d481bafc6ca5

Subscribe to this mod's changes

pypi-ops is a skill published in the GitHub repository 0xDarkMatter/claude-mods (35 stars, last pushed 17d ago), licensed MIT. It adds 74 tokens to every session and 3,169 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

CI and CD Claude Code DevOps and cloud Languages Python agent-skills ai-agents ai-tools anthropic claude

ai-ml-development

AI and machine learning development with PyTorch, TensorFlow, and LLM integration. Use when building ML models, training pipelines, fine-tuning LLMs, or implementing AI features.

travisjneuman/.claude · 43 tokens

python-logging-best-practices

Python logging with loguru, structlog, and orjson. TRIGGERS - loguru, structlog, structured logging.

terrylica/cc-skills · 34 tokens

python-memory-safe-scripts

Memory-safe Python script patterns for long-running processes under systemd MemoryMax constraints. Covers allocator purge (mimalloc/glibc malloctrim), HTTP response lifecycle, DataFrame cleanup, thread-local connection reuse, and periodic GC cadence. Battle-tested through 5 OOM optimization cycles on production GPU…

terrylica/cc-skills · 197 tokens

pypi-doppler

LOCAL-ONLY PyPI publishing with Doppler credentials. TRIGGERS - publish to PyPI, pypi upload, local publish. NEVER use in CI/CD.

terrylica/cc-skills · 42 tokens

python-workspace

Python workspace for MQL5 integration. TRIGGERS - MetaTrader 5 Python, mt5 package, MQL5-Python setup.