Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add phazurlabs/install-labs --skill pypi-agent-packaginggit clone --depth 1 https://github.com/phazurlabs/install-labsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/phazurlabs/install-labs/pypi-agent-packaging)<a href="https://agentmods.dev/skills/phazurlabs/install-labs/pypi-agent-packaging"><img src="https://agentmods.dev/badge/skills/phazurlabs/install-labs/pypi-agent-packaging/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/phazurlabs/install-labs/pypi-agent-packaging"><img src="https://agentmods.dev/badge/skills/phazurlabs/install-labs/pypi-agent-packaging.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00103 | $0.06663 |
| Opus 5 | $0.00051 | $0.03331 |
| Sonnet 5 | $0.00021 | $0.01333 |
| Haiku 4.5 | $0.00010 | $0.00666 |
Grade B, and why
pypi-agent-packaging scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Unrestricted tool accessmediumExcessive agency
A wildcard tool grant or "run any command" leaves no least-privilege boundary at all.
# SECURITY RISK — pickle can execute arbitrary code on load How it starts
The opening of the file, as written. The whole thing — 853 lines — stays where its author put it; the contents beside it link to each section on GitHub.
PyPI Agent Packaging
When to Use PyPI
PyPI is the right distribution channel when:
| Situation | Use PyPI? | Why |
|---|---|---|
| Agent built with Python | Yes | Users expect pip install for Python tools |
| LangChain / CrewAI / AutoGen agent | Yes | Entire ecosystem is Python-native |
| Python CLI tool (ask questions, get answers) | Yes | uvx my-agent "query" is zero-install |
| MCP server written in Python | Yes | uvx my-mcp-server is the standard MCP pattern |
| Agent needs GPU inference (PyTorch, transformers) | Yes (with extras) | pip install my-agent[gpu] keeps base install light |
| Multi-service system (agent + DB + vector store) | No | Use Docker Compose instead |
| Agent written in Node.js / TypeScript | No | Use npm instead |
| Users are non-technical | No | Use a desktop app, web app, or Docker one-click deploy |
The key advantage of PyPI: uvx my-agent gives users a zero-install experience. No cloning, no virtual environment setup, no dependency management. It just works.
pyproject.toml Anatomy for AI Agents
pyproject.toml is the single source of truth for your Python package. Every field below is annotated with why it matters for agents specifically.
[project]
name = "my-agent" # PyPI package name (globally unique)
version = "0.1.0" # Semver — bump on every publish
description = "An AI agent that researches topics and writes summaries"
readme = "README.md"
license = { text = "MIT" }
requires-python = ">=3.11" # Pin minimum Python — agents use modern features
authors = [
{ name = "Your Name", email = "[email protected]" },
]
keywords = ["ai", "agent", "langchain", "cli"]
classifiers = [
"Development Status :: 4 - Beta",
"Environment :: Console",
"Intended Audience :: Developers",
"Programming Language :: Python :: 3.11",
"Programming Language :: Python :: 3.12",
"Programming Language :: Python :: 3.13",
"Topic :: Scientific/Engineering :: Artificial Intelligence",
]
# Core dependencies — keep this list SMALL
# Users who run `pip install my-agent` get only these
dependencies = [
"anthropic>=0.40.0", # API client (lightweight)
"click>=8.0", # CLI framework
"python-dotenv>=1.0", # .env file support
"rich>=13.0", # Terminal formatting
"httpx>=0.27", # Async HTTP client
]
[project.optional-dependencies]
# Heavy ML deps are opt-in, not forced on every user
gpu = [
"torch>=2.0",
"transformers>=4.40",
"sentence-transformers>=3.0",
]
# LangChain ecosystem (large dependency tree)
langchain = [
"langchain>=0.3.0",
"langchain-anthropic>=0.3.0",
"langchain-community>=0.3.0",
]
# Development tools
dev = [
"pytest>=8.0",
"pytest-asyncio>=0.24",
"ruff>=0.8.0",
"mypy>=1.13",
]
# THIS IS CRITICAL — without this, your agent has no CLI command
[project.scripts]
my-agent = "my_agent.cli:main" # `my-agent` command → calls main() in cli.py
# For MCP servers, also add:
# my-agent-mcp = "my_agent.mcp_server:main"
[project.urls]
Homepage = "https://github.com/your-org/my-agent"
Repository = "https://github.com/your-org/my-agent"
Issues = "https://github.com/your-org/my-agent/issues"
# =========================================================================
# Build system — Hatchling is modern, fast, and requires minimal config
# =========================================================================
[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"
[tool.hatch.build.targets.wheel]
packages = ["src/my_agent"] # Tells hatch where to find your package
# =========================================================================
# Tool configurations
# =========================================================================
[tool.ruff]
target-version = "py311"
line-length = 100
[tool.ruff.lint]
select = ["E", "F", "I", "N", "UP", "B", "SIM"]
[tool.pytest.ini_options]
testpaths = ["tests"]
asyncio_mode = "auto"
[tool.mypy]
python_version = "3.11"
strict = true
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 853 lines · 103 tokens per session scan B ccbd90b42fe8
pypi-agent-packaging is a skill published in the GitHub repository phazurlabs/install-labs (3 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 103 tokens to every session and 6,663 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it B with 1 finding (unrestricted tool access). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
uv-usage
Provides concise guidance for using uv (Python package manager), including project workflows, pip-compatible commands, Python version management, and PEP 723 inline script dependencies. Use when users mention uv, uv run, inline dependencies, PEP 723, or Python dependency/project management.
aws-lambda-python
AWS Lambda development with Python. Use when writing Lambda handlers, packaging with layers, using boto3/Powertools, structured logging or optimizing Python Lambda performance.
python-runtime
Python toolchain configuration and best practices. Use when setting up Ruff, pytest, mypy type hints, dependency management, virtual environments or Python project standards.
django-conventions
Django patterns. Use when building or reviewing Django apps.
flask-conventions
Flask patterns. Use when building or reviewing Flask apps.
python-conventions
Idiomatic, readable Python. Use when writing or reviewing Python.