Skills python-venv-manager

📦

python-venv-manager

Name: python-venv-manager
Author: CuriousLearner

Content revision r1 Critical ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables

Manage Python Virtual Environments

Python projects often fail because environments, versions, and dependencies drift across machines. This skill gives Claude, Codex, and Claude Code structured guidance for creating reproducible Python setups.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Do not auto-install this skill.

The canonical policy requires operator review before any installation action.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "python-venv-manager" from https://skillstore.io/skills/curiouslearner-python-venv-manager.md and its manifest at https://skillstore.io/api/skills/curiouslearner-python-venv-manager/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/curiouslearner-python-venv-manager.md Signed manifest GET /api/skills/curiouslearner-python-venv-manager/manifest Signed lockfile GET /api/skills/curiouslearner-python-venv-manager/lockfile

Test it

Using "python-venv-manager". Set up a new Python CLI project with Poetry.

Expected outcome:

A step-by-step setup plan covering Poetry initialization, dependency groups, pytest, formatting tools, and verification commands.

Using "python-venv-manager". My imports work locally but fail in CI.

Expected outcome:

Check which Python interpreter CI uses.
Verify the virtual environment is active.
Install the package in editable mode if using a src layout.
Run dependency checks before changing versions.

Using "python-venv-manager". Move a requirements.txt project to a locked workflow.

Expected outcome:

A migration outline that backs up current files, imports dependencies, creates a lock file, and tests installation in a clean environment.

Security Audit

Critical

v9 • 7/9/2026 Open versioned report

Most static findings are false positives caused by markdown code fences and normal Python environment documentation. Confirmed risks remain for remote installer commands piped into shells, shell expansion of dependency files, xargs-based package installation, and examples that create local .env files with secret-like values.

Files scanned

1,016

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (3)

Critical

SKILL.md:147

Pipe to shell pattern

curl https://pyenv.run | bash

The documented command pipes a remote pyenv installer directly into bash. This is a real supply-chain risk because downloaded code executes without inspection.

Critical

SKILL.md:415

Pipe to shell pattern

curl https://pyenv.run | bash

The documented command pipes a remote pyenv installer directly into bash. This is a real supply-chain risk because downloaded code executes without inspection.

High

SKILL.md:652

Environment file access

cat > .env << EOF

The example creates a .env file that contains secret-like values. This is common setup guidance, but it can create sensitive local files if copied into a repository.

Capability review items (16)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

SKILL.md:655

Database connection strings

DATABASE_URL=postgresql://user:pass@localhost/db

The example writes placeholder SECRET_KEY and DATABASE_URL values into a .env file. They are examples, but they normalize creating local secret files and need clear handling warnings.

High

SKILL.md:654

Generic API/secret keys

SECRET_KEY=your-secret-key

The example writes placeholder SECRET_KEY and DATABASE_URL values into a .env file. They are examples, but they normalize creating local secret files and need clear handling warnings.

Medium

SKILL.md:275

Shell command substitution

poetry add $(cat requirements.txt)

The command expands the full contents of requirements.txt into a package install command. Malformed or unexpected file contents could alter the install operation.

Medium

SKILL.md:420

Shell command substitution

eval "$(pyenv init -)"

The command evaluates shell output from pyenv initialization. This is a standard pyenv pattern, but eval of generated shell text is still a real execution risk if the tool is compromised.

Medium

SKILL.md:421

Shell command substitution

eval "$(pyenv virtualenv-init -)"

The command evaluates shell output from pyenv initialization. This is a standard pyenv pattern, but eval of generated shell text is still a real execution risk if the tool is compromised.

Medium

SKILL.md:831

Shell command substitution

pkg_name=$(echo $package | cut -d'=' -f1 | cut -d'>' -f1 | cut -d'<' -f1)

The migration script processes untrusted requirements lines through shell parsing. Package names are quoted later, but the loop still depends on shell handling of file content.

Medium

SKILL.md:854

Shell command substitution

poetry add $(pipenv requirements | sed 's/==/=/g')

The command substitution passes Pipenv output directly into poetry add. Unexpected dependency text could change arguments or install unintended packages.

Medium

SKILL.md:267-285

Template literal with command substitution

```bash

The surrounding bash block contains command substitution or shell evaluation patterns. These are legitimate examples, but they can execute unintended input if copied without review.

Medium

SKILL.md:413-447

Template literal with command substitution

```bash

The surrounding bash block contains command substitution or shell evaluation patterns. These are legitimate examples, but they can execute unintended input if copied without review.

Medium

SKILL.md:816-840

Template literal with command substitution

```bash

The surrounding bash block contains command substitution or shell evaluation patterns. These are legitimate examples, but they can execute unintended input if copied without review.

Medium

SKILL.md:843-855

Template literal with command substitution

```bash

The surrounding bash block contains command substitution or shell evaluation patterns. These are legitimate examples, but they can execute unintended input if copied without review.

Medium

SKILL.md:818

Unix shell invocation

#!/bin/bash

The skill includes a bash migration script. Script execution is expected for this domain, but it can modify dependency files and install packages.

Medium

SKILL.md:848

xargs command (can execute arbitrary commands)

cat requirements.txt | xargs poetry add

The command feeds requirements.txt entries directly through xargs into poetry add. Unreviewed dependency file contents could cause unintended package installation or argument changes.

Low

SKILL.md:88

Hardcoded URL

curl -sSL https://install.python-poetry.org | python3 -

The Poetry installer is fetched remotely and piped to Python. This is a common install method but still executes downloaded installer code.

Low

SKILL.md:147

Hardcoded URL

curl https://pyenv.run | bash

The URL is part of a remote installer command that is piped to bash. The network access is intentional, but it increases supply-chain exposure.

Low

SKILL.md:415

Hardcoded URL

curl https://pyenv.run | bash

The URL is part of a remote installer command that is piped to bash. The network access is intentional, but it increases supply-chain exposure.

Risk Factors

⚙️ External commands (50)

SKILL.md:47-65 SKILL.md:65-68 SKILL.md:68-80 SKILL.md:80-83 SKILL.md:83-115 SKILL.md:115-118 SKILL.md:118-139 SKILL.md:139-142 SKILL.md:142-167 SKILL.md:167-171 SKILL.md:171-178 SKILL.md:178-183 SKILL.md:183-224 SKILL.md:224-227 SKILL.md:227-264 SKILL.md:264-267 SKILL.md:267-285 SKILL.md:285-290 SKILL.md:290-314 SKILL.md:314-317 SKILL.md:317-339 SKILL.md:339-342 SKILL.md:342-373 SKILL.md:373-376 SKILL.md:376-408 SKILL.md:408-413 SKILL.md:413-447 SKILL.md:447-450 SKILL.md:450-471 SKILL.md:471-476 SKILL.md:476-486 SKILL.md:486-489 SKILL.md:489-511 SKILL.md:511-514 SKILL.md:514-545 SKILL.md:545-550 SKILL.md:550-568 SKILL.md:568-571 SKILL.md:571-588 SKILL.md:588-591 SKILL.md:591-605 SKILL.md:605-608 SKILL.md:608-618 SKILL.md:618-621 SKILL.md:621-630 SKILL.md:630-633 SKILL.md:633-642 SKILL.md:642-647 SKILL.md:647-668 SKILL.md:668-671

🌐 Network access (9)

SKILL.md:284 SKILL.md:88 SKILL.md:147 SKILL.md:350 SKILL.md:415 SKILL.md:782 SKILL.md:788 SKILL.md:794 SKILL.md:799

📁 Filesystem access (5)

SKILL.md:418 SKILL.md:916 SKILL.md:917 SKILL.md:918 SKILL.md:902

🔑 Env variables (28)

Detected Patterns

Pipe to shell pattern×2

Audited by: claude View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/curiouslearner-python-venv-manager/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/curiouslearner-python-venv-manager/security.svg)](https://skillstore.io/skills/curiouslearner-python-venv-manager?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/curiouslearner-python-venv-manager?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/curiouslearner-python-venv-manager/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/curiouslearner-python-venv-manager.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

CuriousLearner. (2026). python-venv-manager security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/curiouslearner-python-venv-manager/audits/9

BibTeX citation

@techreport{curiouslearner-curiouslearner-python-venv-manager-2026,
  author = {CuriousLearner},
  title = {python-venv-manager security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/curiouslearner-python-venv-manager/audits/9},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "python-venv-manager security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
  - name: "CuriousLearner"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/curiouslearner-python-venv-manager/audits/9"
identifiers:
  - type: other
    value: "skillstore:curiouslearner-python-venv-manager:audit:9"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Start a clean Python project

Create a reproducible project structure with a virtual environment, dependencies, tests, and formatting tools.

Standardize team environments

Choose between Poetry, pip-tools, Pipenv, and pyenv for consistent development setup across a team.

Troubleshoot dependency problems

Diagnose import errors, package conflicts, SSL certificate failures, and broken virtual environments.

Try These Prompts

Create a basic virtual environment

Use python-venv-manager to show me the safest steps to create a virtual environment, activate it, install packages, and save dependencies.

Choose a dependency tool

Use python-venv-manager to compare venv, Poetry, Pipenv, and pip-tools for my Python web service. Recommend one approach and explain the tradeoffs.

Fix dependency conflicts

Use python-venv-manager to help debug my Python dependency conflict. Ask for the package files you need, then propose safe commands to inspect and resolve it.

Plan a Poetry migration

Use python-venv-manager to plan a migration from requirements.txt to Poetry for an existing application. Include validation steps and rollback considerations.

Best Practices

Review installer commands before running them, especially commands downloaded with curl.
Use lock files or hashed requirements for production deployments.
Test dependency updates in a clean virtual environment before merging them.

Avoid

Do not pipe remote install scripts directly into a shell without inspection.
Do not install project dependencies into the global Python environment.
Do not commit .env files, virtual environments, or generated cache directories.

Frequently Asked Questions

Does this skill create virtual environments automatically?

No. It provides guidance and command examples that an agent or user may run after review.

Which tools does it cover?

It covers venv, virtualenv, Poetry, Pipenv, pyenv, pip-tools, pytest, pre-commit, and Docker examples.

Is it safe for production projects?

Use it as guidance only. Review all commands, pin dependencies, and avoid remote shell installers in production workflows.

Can it fix dependency conflicts?

It can suggest diagnostic and resolution steps, but it needs project files and test results for accurate fixes.

Does it support Claude Code?

Yes. The report marks it as compatible with Claude, Codex, and Claude Code.

What should I review before using it?

Review commands that install packages, modify shell configuration, create .env files, or read dependency lists into shell commands.

Developer Details

Author

CuriousLearner

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/CuriousLearner/devkit/tree/main/skills/python-venv-manager

Ref

7db9b9f06e0ab79c575b58bc48c4d8dc9849f424

Maintenance freshness

7/18/2026

Usage

5 downloads · 339 views

File structure

📄 SKILL.md