Monty is a minimal Python interpreter written in Rust that runs AI-generated code in a restricted environment without direct filesystem, environment-variable, or network access. It is for AI agents that need to execute Python and type-checking tasks while allowing developers to control which host functions and objects the code can use, and the catalogue entries integrate it into agent workflows.
Borrowing it
Nothing to install: this file belongs to pydantic/monty. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/pydantic/monty/main/.agents/skills/review-security/SKILL.mdgit clone --depth 1 https://github.com/pydantic/montyWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pydantic/monty/review-security)<a href="https://agentmods.dev/skills/pydantic/monty/review-security"><img src="https://agentmods.dev/badge/skills/pydantic/monty/review-security/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/pydantic/monty/review-security"><img src="https://agentmods.dev/badge/skills/pydantic/monty/review-security.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00055 | $0.00724 |
| Opus 5 | $0.00028 | $0.00362 |
| Sonnet 5 | $0.00011 | $0.00145 |
| Haiku 4.5 | $0.00006 | $0.00072 |
Grade A, and why
review-security scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 58 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Security review
Monty runs untrusted, potentially malicious Python. Review this branch on that basis.
git diff origin/main...HEAD
Use a subagent to run .agents/skills/fix-pr-comments/pr-threads.sh (from the
fix-pr-comments skill) for security findings already raised on the PR, and confirm
each is properly addressed.
Cover the changes and any code they touch — a caller made unsafe by a changed callee is in scope even if it isn't in the diff. Ask:
- Sandbox escape? Filesystem access outside a mount, path traversal, symlinks resolving out of bounds, network, subprocesses, import-system abuse, callback misuse, leaks through error messages or timing.
- Memory errors? Worse than panics: nothing stops, state is silently corrupt, and it
can become arbitrary execution.
unsafe, refcount errors causing use-after-free or double-free, unchecked indexing, aliasing violations, integer overflow feeding a length or index. - Resource limits bypassed? Allocations dodging the
ResourceTracker(StringwithoutStringBuilder), loops with no fuel check, small input → huge allocation. - Untrusted input still untrusted? Wire frames from a child are hostile: decoding and proto→Rust conversion must validate everything and never panic. (Snapshots and dumps are trusted by contract — hosts sign and verify them.)
- Panics or aborts?
unwrap/expectreachable from sandboxed input, unbounded recursion hitting a stack-overflow abort. - Mount escapes? Any behaviour that allows sandbox code to escape a filesystem mount and read or alter files outside the mount point. This is particularly severe since mounts are run on the host/client connecting to a sandbox - accessing that environment is a very serious breach of the sandbox and security issue.
Weight both classes by where they land. In a pool worker the process dies, the parent
replaces the child and raises an exception — contained. Nothing else is: in host/parent
code (monty-pool, monty-proto decoding, monty-fs, the bindings), or in a Rust
embedder calling the monty crate in-process, the same bug takes down the application.
Scrutinise those hardest, especially anything handling a frame from a child.
crates/monty/src/heap.rs and crates/monty-fs/src/path_security.rs are the two most
security-critical files; any change to either needs careful justification. Also check the
public API: could a pydantic_monty or @pydantic/monty user misuse this to expose
their host?
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago Changed 7c6a47aa96cb
- 9d ago First seen · 58 lines · 55 tokens per session scan A a72753ae04b4
review-security is a skill published in the GitHub repository pydantic/monty (8,184 stars, last pushed yesterday), licensed MIT. It adds 55 tokens to every session and 724 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
polars
High-performance DataFrame library for Python ETL, analytics, and pandas migration. Use for expression-based data manipulation with lazy query optimization, parallel execution, streaming out-of-core processing, Arrow interoperability, and optional GPU execution.
gh-find-prs
Survey open Codewhale PRs and triage each for mergeability and disposition against the real landing branch.
code-review
Perform a structured code review of changes, checking for correctness, style, tests, and potential issues.
code-review
Code review assistance with linting, style checking, and best practices.
tuicr
Use tuicr's review CLI to read and add comments in active TUI review sessions, and launch tuicr in cmux, tmux, Zellij, or Herdr when a user needs an interactive review pane.
dd-code-generation
Use pup CLI for immediate Datadog operations or generate code for integration into applications.