Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/w2ur/claude-code-setup/python-uvnpx skills add w2ur/claude-code-setup --skill python-uvgit clone --depth 1 https://github.com/w2ur/claude-code-setupWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00058 | $0.01457 |
| Opus 5 | $0.00029 | $0.00728 |
| Sonnet 5 | $0.00012 | $0.00291 |
| Haiku 4.5 | $0.00006 | $0.00146 |
Grade A, and why
python-uv scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 112 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Python on this machine — the reasons
The hard rules live in ~/.claude/CLAUDE.md. This skill holds the measurements
behind them, so that a future session does not re-derive the wrong belief from the
same evidence and "fix" something that is already correct.
Decided 2026-08-17.
No pyenv — ~/.pyenv does not exist and must not come back. No development
Python from Homebrew. No pip install into a system interpreter.
The enforcement lives in uv.toml, and that is the whole point
~/.config/uv/uv.toml sets python-preference = "only-managed". That is what
actually enforces uv-only Python: uv then refuses a system interpreter outright.
It is deliberately not in ~/.zshrc. A shell export reaches interactive shells
only — a LaunchAgent and a cron entry never source .zshrc — so setting it there
leaves it unset in exactly the place a wrong interpreter would be invisible.
uv's default without the setting is "prefer managed, but fall back to a system
Python if no managed one is installed", so the gap is real rather than theoretical.
env-drift-check.py's uv run --script shebang runs under the vigie LaunchAgent and
picks correctly today only because managed 3.11/3.12/3.13 happen to be installed.
The falsifying control that was actually run. uv discovers
~/.config/uv/uv.toml on every invocation regardless of shell. Verified with a
probe file set to only-system: that flipped uv python find to Homebrew's 3.14
with no env var set, and the same run without the file did not. The check was made
to produce the opposite answer before its silence was trusted.
Note UV_PYTHON_PREFERENCE is absent from uv 0.12.5's --help, which documents
UV_MANAGED_PYTHON instead. The old var is still parsed, but the config key is
the stable form — write the config key.
Homebrew's [email protected] stays installed, and that is not a loophole
It is installed_on_request=false — a dependency of gcloud-cli, mpv, yt-dlp,
vapoursynth and peon-ping. brew uninstall [email protected] takes those with it.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 112 lines · 58 tokens per session scan A 23fbcd4eb85b
python-uv is a skill published in the GitHub repository w2ur/claude-code-setup (2 stars, last pushed 9d ago), licensed MIT. It adds 58 tokens to every session and 1,457 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
clinpgx-database
Access ClinPGx pharmacogenomics data (successor to PharmGKB). Query gene-drug interactions, CPIC guidelines, allele functions, for precision medicine and genotype-guided dosing decisions.
embedding-strategies
Select and optimize embedding models for semantic search and RAG applications. Use when choosing embedding models, implementing chunking strategies, or optimizing embedding quality for specific domains.
docx-comment-reply
Reply to comments (批注) in Word .docx/.doc files: extract comment context, draft replies, write threaded replies back, and validate OOXML.
flow-next-resolve-pr
Resolve PR review feedback. Fetches unresolved threads, triages, fixes, replies and resolves via GraphQL. Use when asked to address review comments.
flow-next-tracker-sync
Project a flow-next spec to a tracker issue (Linear, GitHub, GitLab, Jira) and reconcile two-way. Use when asked to sync to a tracker. NOT plan-sync.
flow-next-prime
Assess codebase agent and production readiness. Classifies the project, verifies commands run, leads with a verdict and ranked next actions.