Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/leynier/python-template/validate-python-stacknpx skills add leynier/python-template --skill validate-python-stackgit clone --depth 1 https://github.com/leynier/python-templateWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00051 | $0.00437 |
| Opus 5 | $0.00026 | $0.00218 |
| Sonnet 5 | $0.00010 | $0.00087 |
| Haiku 4.5 | $0.00005 | $0.00044 |
Grade A, and why
validate-python-stack scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Validate Python Stack
Choose the validation path that matches the current directory and report exact failures without hiding skipped checks.
Template Repository
- Run
uv sync --all-groups. - Run
uv run python scripts/compile_catalog.py --check. - Run
uv run ruff check .anduv run ruff format --check .. - Run
uv run pytest -n auto. Use focused tests first while iterating, but finish with the full suite. - For every directory under
skills/, run the skill-creator validator when available and runnpx --yes skills add . --listto verify discovery. - Generate the changed presets or custom combinations and exercise their real CLI, API, MCP, training, serving, or deployment entry point as applicable.
- If GitHub workflows changed and Docker is available, run the repository's local Actions validation before pushing.
Generated Project
- Read
.copier-answers.yml,readme.md, andpyproject.tomlto identify enabled layers. - Run
uv sync --all-groups,uv run ruff check .,uv run ruff format --check ., anduv run pytest. - Run
npx --yes skills add . --list; expectproject-workflowand only the conditional skills appropriate to the selected stack. - Exercise the primary entry point. For a containerized target, build the Docker image and verify its health route locally when Docker is available.
- Validate generated JSON, TOML, YAML, Python, and HCL as structured data rather than with string-only assertions.
Reporting
Separate passed, failed, and unavailable checks. Include the command, relevant error, and whether the failure belongs to the template, the generated project, local infrastructure, or an external service.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 31 lines · 51 tokens per session scan A bf1a59dd5a26
validate-python-stack is a skill published in the GitHub repository leynier/python-template (37 stars, last pushed 3d ago), licensed MIT. It adds 51 tokens to every session and 437 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
heaven-style
Standalone personal code-quality, architecture, documentation, graphical-interface, and project-management guide for TypeScript and Python repositories. Use when writing or reviewing code or docs, designing architecture or UI, refactoring, or aligning tests; apply repository policy first, then shared design philosophy…
datamodel-code-generator
Use this skill when the user wants Python data models, Pydantic models, dataclasses, TypedDicts, msgspec structs, or type-safe Python classes generated from OpenAPI, AsyncAPI, JSON Schema, GraphQL, JSON/YAML/CSV sample data, MCP tool schemas, Protocol Buffers, XML Schema, Apache Avro, or existing Python model objects.…
background-task
Add or modify work that runs outside the request/response cycle — emails, document ingestion, webhooks, cleanups, scheduled jobs. Use when something is slow or fire-and-forget, or when adding a periodic/cron task. This project's queue is {{ cookiecutter.backgroundtasks }}.
frontend-feature
Build a new page, view, or data-driven feature in the Next.js frontend. Use when adding a route under the dashboard/marketing area, wiring UI to a backend endpoint, adding client state, or creating a localized page. Covers App Router, data fetching, Zustand stores, and i18n.
rag-knowledge
Work with the RAG knowledge base — ingest documents, run semantic search, manage collections, or add a sync source/connector (Google Drive, S3). Use when populating or debugging the knowledge base, tuning retrieval, or adding a new document source. This project uses {{ cookiecutter.vectorstore }} + {{…
alembic-migration
Create, review, and apply database schema changes with Alembic. Use whenever a SQLAlchemy model is added or changed, a column/index/constraint needs to change, or a data backfill is required — anything that alters the PostgreSQL schema.