What is ai-agents-build-and-env?

A setup runbook for recreating the repository's development environment from a fresh clone. It explains the required Python version, dependency setup, Git hooks, MCP layer, and common installation problems.

Use it to bootstrap a new checkout, install the expected tools, or work around environment-specific issues.

It removes guesswork when preparing the project and helps diagnose setup errors such as a missing Python module.

ai-agents-build-and-env — Skill for Claude Code by rjmurillo/ai-agents

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add rjmurillo/ai-agents --skill ai-agents-build-and-env

Clone the repo

git clone --depth 1 https://github.com/rjmurillo/ai-agents

Made for: Claude Code.

Or install project-toolkit, the plugin that ships this one along with the rest of its 125 skills, 25 commands, 33 agents, 5 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/rjmurillo/ai-agents/ai-agents-build-and-env/github.svg)](https://agentmods.dev/skills/rjmurillo/ai-agents/ai-agents-build-and-env)

Your own site

<a href="https://agentmods.dev/skills/rjmurillo/ai-agents/ai-agents-build-and-env"><img src="https://agentmods.dev/badge/skills/rjmurillo/ai-agents/ai-agents-build-and-env/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/rjmurillo/ai-agents/ai-agents-build-and-env"><img src="https://agentmods.dev/badge/skills/rjmurillo/ai-agents/ai-agents-build-and-env.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 117 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 3,713 The whole file, excluding the scripts and references it only reads on demand.

Security scan B 2 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector warn 7 Sept 2026

SkillSpector: 5 findings, up to high

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

high Agent Snooping · line 204
Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Fix: Remove all code or instructions that read MCP configuration files (mcp.json). MCP server details should be managed by the agent runtime, not read by individual skills.
high Privilege Escalation · line 205
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
high Rogue Agent · line 213
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Fix: Prevent the skill from modifying its own code, SKILL.md, or configuration files. Treat skill files as read-only at runtime.
medium MCP Rug Pull · line 122
uvx/uv tool run commands without ==version create a rug-pull risk.

Fix: Pin the version: uvx package-name==1.2.3
medium MCP Rug Pull · line 123
uvx/uv tool run commands without ==version create a rug-pull risk.

Fix: Pin the version: uvx package-name==1.2.3

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00117	$0.03713
Opus 5.5	$0.00047	$0.01485
Sonnet 5.5	$0.00023	$0.00743
Haiku 4.5	$0.00012	$0.00371

Measured 6d ago against content hash 2b013d9a5167, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade B, and why

ai-agents-build-and-env scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.

The scan reads SKILL.md. This mod also ships 1 executable file (tests/test_structure_ai_agents_build_and_env.py), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Reads MCP configurationmediumAgent snooping

mcp.json carries server URLs and auth tokens; reading it lets a mod discover and abuse other integrations.

| MCP servers serena/deepwiki | `.mcp.json` | `cat .mcp.json` |

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

| git, jq, curl | any recent | `git --version` |

.claude/skills/ai-agents-build-and-env/SKILL.md · 223 lines

How it starts

The opening of the file, as written. The whole thing — 223 lines — stays where its author put it; the contents beside it link to each section on GitHub.

ai-agents Build and Environment Runbook

Recreate a working dev environment for this repository from a fresh clone, verify it actually works, and avoid the traps that have cost prior contributors real time. Audience: a zero-context mid-level engineer or Sonnet-class model. Every command below was verified against the repo on 2026-07-03; the Provenance section gives a re-verification one-liner for each volatile fact.

Triggers

set up this repo
bootstrap the environment
fresh clone setup
ModuleNotFoundError: No module named yaml
environment traps

Scope

This skill is environment setup and survival only. Adjacent problems route to siblings:

You want	Use instead
Regenerate mirrors, run the drift gates, release	`ai-agents-generation-and-release`
Understand what counts as test evidence, run CI-equivalent gates	`ai-agents-validation-and-qa`
Full catalog of env vars, skip markers, escape hatches	`ai-agents-config-catalog`
Triage a failing hook, gate, or test	`ai-agents-debugging-playbook`

Process

Phase 1: Prerequisites

The interpreter version has ONE source of truth: .python-version (currently 3.14.6, as of 2026-07-03). Do not hardcode versions anywhere; read the pin.

Tool	Floor	Verify
uv	Must resolve the `.python-version` pin (old container uv builds cannot; reinstall via the astral.sh standalone installer, never `uv self update`, which hits GitHub API rate limits on shared egress IPs)	`uv python list "$(cat .python-version)"` prints a row
Python	Exactly the `.python-version` pin, installed by uv	`python3 --version`
Node.js	22 LTS (`NODE_MAJOR=22` in `scripts/bootstrap-vm.sh:84`; AGENTS.md floor says "Node LTS")	`node --version`
PowerShell	7.5.4+ per AGENTS.md Stack. Note: zero `.ps1` files remain in the repo (ADR-042 Python migration), so pwsh is rarely exercised, but the floor is still declared	`pwsh --version`
gh CLI	2.60+ per AGENTS.md Stack	`gh --version`
git, jq, curl	any recent	`git --version`

Read the full file on GitHub · 223 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

tests/test_structure_ai_agents_build_and_env.py 1.1 KB runs code

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

6d ago Changed · +1 lines 2b013d9a5167
18d ago Changed e55786716624
22d ago Changed · +6 lines 714059801fc6
1mo ago Changed · +2 lines 02148f2e6222
1mo ago Changed · -2 lines f43dd9d5fa7d
1mo ago First seen · 216 lines · 117 tokens per session scan B 422fb78a7538

Subscribe to this mod's changes

ai-agents-build-and-env is a skill published in the GitHub repository rjmurillo/ai-agents (48 stars, last pushed today), licensed MIT. It adds 117 tokens to every session and 3,713 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it B with 2 findings (reads mcp configuration, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

CI and CD Claude Code Code review DevOps and cloud agentic-ai ai-agents developer-tools github-copilot

install-gemini-code-review-action

Installs, configures, or upgrades Dazbo's PR code review & issue triage GitHub Action (gemini-review-action) in a target repository. Use when the user wants to set up, configure, or update automated AI code reviews, issue triaging, or Gemini model workflows for their GitHub repository.

derailed-dash/dazbo-agent-skills · 73 tokens

ai-agents-build-and-env