python-env
Manage Python Environments with uv
Python environments and dependency files can become slow, inconsistent, and difficult to reproduce. This skill provides practical uv workflows for setup, locking, testing, and publishing.
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Review the Skillstore skill "python-env" from https://skillstore.io/skills/0xdarkmatter-python-env.md and its manifest at https://skillstore.io/api/skills/0xdarkmatter-python-env/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "python-env". Create a Python 3.12 API project with FastAPI, pytest, and Ruff.
Expected outcome:
The response proposes a package layout, initializes Python 3.12, separates runtime and development dependencies, and lists validation steps.
Using "python-env". Convert this requirements-based project to uv.
Expected outcome:
The response maps direct dependencies into project metadata, creates development groups, generates a lockfile, and notes remaining legacy constraints.
Using "python-env". Prepare version 1.2.0 for publication.
Expected outcome:
The response checks metadata, changelog, tests, build artifacts, TestPyPI installation, release tags, and trusted publishing configuration.
Security Audit
CriticalThe audit confirmed one critical issue: SKILL.md recommends piping a remote installer directly into a shell. The other 87 findings are documentation examples or Markdown syntax without dangerous execution, access, or exfiltration intent.
Confirmed security concerns (1)
Risk Factors
🌐 Network access (20)
📁 Filesystem access (5)
⚙️ External commands (50)
🔑 Env variables (1)
Detected Patterns
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/0xdarkmatter-python-env/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/0xdarkmatter-python-env?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/0xdarkmatter-python-env?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/0xdarkmatter-python-env/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/0xdarkmatter-python-env.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
0xDarkMatter. (2026). python-env security audit report (audit version 10) [Author version unspecified]. Skillstore. https://skillstore.io/skills/0xdarkmatter-python-env/audits/10BibTeX citation
@techreport{0xdarkmatter-0xdarkmatter-python-env-2026,
author = {0xDarkMatter},
title = {python-env security audit report (audit version 10)},
institution = {Skillstore},
year = {2026},
number = {10},
url = {https://skillstore.io/skills/0xdarkmatter-python-env/audits/10},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "python-env security audit report (audit version 10)"
version: "unspecified"
type: report
authors:
- name: "0xDarkMatter"
date-released: "2026-07-12"
url: "https://skillstore.io/skills/0xdarkmatter-python-env/audits/10"
identifiers:
- type: other
value: "skillstore:0xdarkmatter-python-env:audit:10"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: MediumWhat You Can Build
Start a Python project
Create a reproducible project with a suitable layout, Python version, dependencies, and development tools.
Modernize dependency workflows
Replace manual virtual environments and pip commands with uv project commands and a committed lockfile.
Prepare a package release
Configure package metadata, build artifacts, test installation through TestPyPI, and use trusted publishing.
Try These Prompts
Set up this Python project with uv. Use Python [version], add [dependencies], and explain each proposed file change.
Add pytest, Ruff, and mypy to this uv project. Update pyproject.toml with practical defaults and run the appropriate checks.
Migrate this repository from requirements files to a uv project workflow. Preserve constraints, separate development dependencies, and describe compatibility risks.
Design a secure uv-based release workflow for this package. Include builds, TestPyPI validation, versioning, GitHub Actions, and PyPI trusted publishing.
Best Practices
- Commit the lockfile and use frozen synchronization in continuous integration.
- Review dependency sources and version changes before installing or upgrading packages.
- Use PyPI trusted publishing instead of storing long-lived upload tokens.
Avoid
- Do not pipe remote installation scripts directly into a shell.
- Do not mix bare Python commands with uv-managed project commands.
- Do not publish artifacts before testing their contents and installation.
Frequently Asked Questions
What does this skill require?
Does it replace pip?
Can it create virtual environments?
Does it support monorepos?
Can it publish packages?
How does it handle secrets?
Developer Details
Author
0xDarkMatterLicense
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Ref
d71c7417a35d5c2624161bd2fe8de8a41a362128
Maintenance freshness
7/18/2026
Usage
33 downloads · 434 views
File structure