Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/bitwise-media-group/skills/python-projectnpx skills add bitwise-media-group/skills --skill python-projectgit clone --depth 1 https://github.com/bitwise-media-group/skillsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00226 | $0.01280 |
| Opus 5 | $0.00113 | $0.00640 |
| Sonnet 5 | $0.00045 | $0.00256 |
| Haiku 4.5 | $0.00023 | $0.00128 |
Grade A, and why
python-project scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 92 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Scaffold a Python project
Creates a Python repository with the src/ layout, uv-managed dependencies, pinned developer
tooling, and a Makefile gate. Apply the python-style, python-typing, and python-testing
skills while filling in real code, and wire releases with the python-release skill.
1. Initialize with uv
uv is the only tool for interpreters, virtual environments, dependencies, locking, building, and
publishing — do not reach for pip, pipenv, poetry, conda, pyenv, or pipx alongside it.
uv init --package myapp # packaged app with a CLI entry point and [build-system]
uv init --lib myapp # importable library (same src/ layout, no console script)
Both flavors produce the src/ layout and a [build-system]; the bare uv init (flat, no build
system) is only for throwaway scripts. uv writes pyproject.toml and src/myapp/, and the first
uv sync/uv run writes the uv.lock you commit.
2. Lay out the tree
pyproject.toml
uv.lock # committed — the reproducible, cross-platform resolution
.python-version # pins the interpreter uv provisions for `uv run`
README.md # referenced by `readme` in pyproject.toml
src/myapp/__init__.py
src/myapp/__main__.py
tests/
Makefile
- src/ layout, never flat. Tests run against the installed package, so a missing
__init__.pyor a packaging mistake fails locally instead of being masked by an import-from-cwd. Copy templates/python-version to.python-version. - One module per concern, named for what it provides (
store,client,config) — neverutils,common, orhelpers.
3. Configure pyproject.toml on the uv_build backend
Copy templates/pyproject.toml. The choices that matter:
[build-system]uses uv's native backend —requires = ["uv_build>=0.11.21,<0.12"],build-backend = "uv_build". It is fast and needs no configuration for the src/ layout; the upper bound keeps builds reproducible as the backend evolves.requires-pythonis the floor (>=3.13);.python-versionpins the interpreter used during development. Runtime dependencies use lower bounds (>=), never==—uv.lockdoes the exact pinning.- The
[tool.ruff],[tool.ty.environment](or[tool.pyright]), and[tool.pytest.ini_options]blocks ship in the same file; their rationale lives in thepython-style,python-typing, andpython-testingskills.
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 92 lines · 0 tokens per session scan A 190c479dbf0b
python-project is a skill published in the GitHub repository bitwise-media-group/skills (2 stars, last pushed yesterday), licensed MIT. It adds 226 tokens to every session and 1,280 once invoked, about $0.0011 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
shipping-reproducible-results
Package completed data analysis and ML work so an independent recipient can reproduce the claimed results, verify artifact lineage, and operate the handoff within its stated scope. Use when finalizing a project, study, model package, or review bundle; not for deploying to a live system.
auditing-data-and-ground-truth
Audit datasets, joins, labels, and ground truth before analysis or modeling. Use when data meaning, row grain, time semantics, source-of-truth reliability, or label construction may invalidate conclusions; not for general model evaluation after the evidence base is already trusted.
designing-leakage-safe-experiments
Design leakage-safe machine learning experiments that mirror real deployment and support fair model comparisons. Use when defining prediction timing, feature eligibility, train-validation-test splits, baselines, metrics, or controlled model iterations; not for auditing whether raw labels are trustworthy.
diagnosing-ml-failures
Isolate the root cause of ML performance drops, inconsistent evaluations, prediction errors, and training-serving mismatches across data, labels, splits, pipelines, models, metrics, and runtime behavior. Use when investigating a reproducible failure or regression, not routine model selection or general performance…
running-decision-grade-data-science
Orchestrate an end-to-end data analysis or machine learning project from decision framing through reproducible handoff. Use when a request spans multiple lifecycle stages or an ambiguous modeling request must become a decision-ready result; use narrower audit or experiment-design skills for isolated reviews.
validating-models-and-claims
Validate trained models and analytical claims against their intended decision, independent evidence, and human-reviewed ground truth. Use when reviewing model performance, analysis conclusions, launch claims, or evaluation reports; use failure diagnosis instead when the main task is locating a known defect.