Borrowing it
Nothing to install: this file belongs to mudrii/hermesd. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/mudrii/hermesd/main/.codex/skills/py-rig/SKILL.mdgit clone --depth 1 https://github.com/mudrii/hermesdWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mudrii/hermesd/py-rig)<a href="https://agentmods.dev/skills/mudrii/hermesd/py-rig"><img src="https://agentmods.dev/badge/skills/mudrii/hermesd/py-rig.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00067 | $0.05473 |
| Opus 5 | $0.00034 | $0.02736 |
| Sonnet 5 | $0.00013 | $0.01095 |
| Haiku 4.5 | $0.00007 | $0.00547 |
Grade A, and why
py-rig scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directorieslowAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
- types in touched code are more precise after the change, not less - the implementation matches the Python standards in `AGENTS.md` and `.codex/rules/` Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 400 lines — stays where its author put it; the contents beside it link to each section on GitHub.
This skill complements AGENTS.md, .codex/rules/python-patterns.md, and .codex/rules/python-idioms.md. It must stay aligned with all three and applies as an execution discipline layer on top of the project's Python standards.
This skill adds execution rigor:
- ATDD/TDD workflow
- SRP, DRY, and OCP decision rules
- explicit dependency injection discipline with a pragmatic carve-out for CLI composition roots
- strict type discipline
- comment quality standards
- structured implementation and review checks
- hermesd-specific invariants (cache-preservation, read-only access, panels as OCP seam)
If AGENTS.md is stricter on any point, follow AGENTS.md.
<when_to_use> Use this skill when:
- implementing a new feature or behavior increment
- refactoring Python code for clearer ownership or testability
- reviewing module boundaries or dependency flow
- replacing hidden collaborator construction with explicit injection
- tightening tests around user-visible or integration behavior
- removing
Anytypes or tightening weak types in touched code - cleaning up hardcoded values or global mutable state </when_to_use>
-
Inspect the project first. Read
pyproject.toml, project layout, localAGENTS.md,CONTRIBUTING.md,CHANGELOG.md, tool configs ([tool.ruff],[tool.mypy],[tool.pytest.ini_options]), and existing tests. -
Define acceptance behavior first. Express the user-visible outcome before writing implementation details.
-
Add or update an acceptance-level test when the project has that layer. For hermesd, the acceptance seam is
Collector → DashboardState → panel renderer. Userich.console.Console(record=True)to capture output for end-to-end render assertions. -
Add the next smallest failing test. Prefer a focused unit or module test for the next behavior increment.
-
Implement the minimum change that makes the test pass. Keep the diff tight. Do not rewrite unrelated code.
-
Refactor while green. Improve naming, cohesion, dependency flow, and readability without changing behavior.
-
Keep standards and user-facing docs in sync. If the task materially changes project conventions, architecture, or workflow expectations, update
AGENTS.mdor the relevant rule/skill in the same change. UpdateCHANGELOG.mdfor user-visible changes andREADME.mdwhen install/usage instructions change. -
Verify locally before opening a PR. Run
uv run ruff check .,uv run ruff format --check .,uv run mypy hermesd,uv run pytest tests/ -v -W error::ResourceWarning,uv run pip-audit,uv lock --check,uv build, wheel smoke installs, anduvx twine check dist/*. CI runs the same gate commands across Python 3.11/3.12/3.13.
<design_rules> Apply these rules during implementation:
- Keep project structure clean and predictable
- SRP: each module, class, and function should have one clear reason to change
- DRY: remove repeated validation, mapping, branching, and policy logic when the abstraction improves clarity
- OCP: extend behavior through composition, Protocols, configuration, and strategy injection instead of invasive branching or copy-paste forks
- Prefer domain-oriented module boundaries over technical dumping grounds
- Keep domain logic separate from transport, persistence, configuration, and presentation concerns
- Prefer the smallest coherent abstraction that solves the real duplication or extension point
- Do not introduce Protocol-first abstractions without real consumer pressure
- Prefer composition over inheritance; keep inheritance hierarchies shallow
OCP example in hermesd. hermesd/panels/__init__.py is the canonical OCP seam: add a new panel by writing hermesd/panels/your_panel.py, adding a _render_your_panel(ctx: PanelRenderContext) wrapper, then registering that wrapper in _RENDERERS and the label in PANEL_NAMES. This pattern is documented in CONTRIBUTING.md#Adding a New Panel.
</design_rules>
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 400 lines · 67 tokens per session scan A 9b9186391459
py-rig is a skill published in the GitHub repository mudrii/hermesd (117 stars, last pushed yesterday), licensed MIT. It adds 67 tokens to every session and 5,473 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-07.
Other skills, from other repositories
adversarial-reviewer
Adversarial code review that assumes bugs exist and hunts for them. Use when asked to review code, find bugs, audit for correctness, stress-test a PR, or when someone says "tear this apart" or "what's wrong with this". Give no benefit of the doubt — every line is guilty until proven innocent.
go-testing
Trigger: Go tests, go test coverage, Bubbletea teatest, golden files. Apply focused Go testing patterns.
semgrep-rule-variant-creator
Creates language variants of existing Semgrep rules. Use when porting a Semgrep rule to specified target languages. Takes an existing rule and target languages as input, produces independent rule+test directories for each language.
brooks-sweep
Full-sweep mode: runs a unified analysis across all quality dimensions — code decay, architecture, tech debt, and test quality — then applies fixes directly to the codebase. Safe changes are auto-applied; risky changes are confirmed before execution. Drawing on twelve classic engineering books. Triggers when: user…
include-test-files-that-assert-on-behavior-being-changed-in-decl
When delegating a task affected by this skill, include.
plugin-review
Review plugin quality with tiered checks and dependency scoping. Use for PR and pre-release audits.