Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add leynier/python-template --skill validate-python-stackgit clone --depth 1 https://github.com/leynier/python-templateWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/leynier/python-template/validate-python-stack)<a href="https://agentmods.dev/skills/leynier/python-template/validate-python-stack"><img src="https://agentmods.dev/badge/skills/leynier/python-template/validate-python-stack/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/leynier/python-template/validate-python-stack"><img src="https://agentmods.dev/badge/skills/leynier/python-template/validate-python-stack.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 16 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 24 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00051 | $0.00437 |
| Opus 5.5 | $0.00020 | $0.00175 |
| Sonnet 5.5 | $0.00010 | $0.00087 |
| Haiku 4.5 | $0.00005 | $0.00044 |
Grade A, and why
validate-python-stack scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Validate Python Stack
Choose the validation path that matches the current directory and report exact failures without hiding skipped checks.
Template Repository
- Run
uv sync --all-groups. - Run
uv run python scripts/compile_catalog.py --check. - Run
uv run ruff check .anduv run ruff format --check .. - Run
uv run pytest -n auto. Use focused tests first while iterating, but finish with the full suite. - For every directory under
skills/, run the skill-creator validator when available and runnpx --yes skills add . --listto verify discovery. - Generate the changed presets or custom combinations and exercise their real CLI, API, MCP, training, serving, or deployment entry point as applicable.
- If GitHub workflows changed and Docker is available, run the repository's local Actions validation before pushing.
Generated Project
- Read
.copier-answers.yml,readme.md, andpyproject.tomlto identify enabled layers. - Run
uv sync --all-groups,uv run ruff check .,uv run ruff format --check ., anduv run pytest. - Run
npx --yes skills add . --list; expectproject-workflowand only the conditional skills appropriate to the selected stack. - Exercise the primary entry point. For a containerized target, build the Docker image and verify its health route locally when Docker is available.
- Validate generated JSON, TOML, YAML, Python, and HCL as structured data rather than with string-only assertions.
Reporting
Separate passed, failed, and unavailable checks. Include the command, relevant error, and whether the failure belongs to the template, the generated project, local infrastructure, or an external service.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 31 lines · 51 tokens per session scan A bf1a59dd5a26
validate-python-stack is a skill published in the GitHub repository leynier/python-template (37 stars, last pushed 15d ago), licensed MIT. It adds 51 tokens to every session and 437 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
pytest
Skill "pytest" from bobmatnyc/claude-mpm-skills, covering pytest - professional python testing, basic pytest, with common plugins, for fastapi testing and for django testing.
python-testing
Write or modify Python tests. Use when: adding new tests, understanding testing conventions, working with fixtures, writing FastAPI route tests, database tests, or following pytest patterns. DO NOT USE FOR RUNNING TESTS. If you are just running tests, not building them, you do not need this.
pytest
Skill "pytest" from bobmatnyc/claude-mpm, covering pytest - professional python testing, basic pytest, with common plugins, for fastapi testing and for django testing.
pytest-service
Write disciplined backend tests for FastAPI services with pytest. Use this skill when adding tests to a Python/FastAPI service, setting up async SQLAlchemy test fixtures, wiring AsyncClient with DI overrides, mocking external clients, or improving test maintainability. Covers fixture design, factory patterns, async…
pytest
Advanced Python unit testing framework for customer support tech enablement, covering FastAPI, SQLAlchemy, PostgreSQL, async operations, mocking, fixtures, parametrization, coverage, and comprehensive testing strategies for backend support systems.
temporal-python-testing
Test Temporal workflows with pytest, time-skipping, and mocking strategies. Covers unit testing, integration testing, replay testing, and local development setup. Use when implementing Temporal workflow tests or debugging test failures.