Skills python-packaging

📦

python-packaging

Name: python-packaging
Author: sickn33

Content revision r1 High Risk 🌐 Network access📁 Filesystem access⚙️ External commands

Build Python Packages for Distribution

Python packaging has many moving parts, including metadata, build outputs, dependencies, and release checks. This skill gives concise patterns for packaging libraries and CLI tools for distribution.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "python-packaging" from https://skillstore.io/skills/sickn33-python-packaging.md and its manifest at https://skillstore.io/api/skills/sickn33-python-packaging/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/sickn33-python-packaging.md Signed manifest GET /api/skills/sickn33-python-packaging/manifest Signed lockfile GET /api/skills/sickn33-python-packaging/lockfile

Test it

Using "python-packaging". Create a package layout for a small utility library.

Expected outcome:

Recommended src layout with project metadata, README, license, tests, and development dependency groups.
Build and validation steps for creating a wheel and source distribution.
Release checklist covering version, changelog, metadata, and clean environment installation.

Using "python-packaging". Package a command-line tool for installation.

Expected outcome:

Entry point strategy for the command name and module function.
Dependency and optional dependency guidance for development and testing.
Checks for local installation, command invocation, and distribution validation.

Using "python-packaging". Plan a secure package publishing process.

Expected outcome:

Recommended TestPyPI trial release before public publishing.
Credential handling notes for scoped tokens or trusted publishing.
Automation review points for build, package check, upload, and post-release verification.

Security Audit

High Risk

v6 • 7/9/2026 Open versioned report

Most static alerts are documentation examples, metadata links, or Markdown formatting rather than executable behavior. The confirmed risk is credential handling around ~/.pypirc, which can store PyPI publishing tokens. No prompt injection or malicious intent evidence was found in the reviewed files.

Files scanned

907

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

High

resources/implementation-playbook.md:444

PyPI config file (may contain tokens)

# Create ~/.pypirc

The section explicitly introduces API token use for ~/.pypirc, and nearby lines include token placeholders. This is a real sensitive-credential handling risk even though the tokens are examples.

Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

resources/implementation-playbook.md:444

Hidden file in home directory

# Create ~/.pypirc

The playbook instructs users to create ~/.pypirc, a hidden home configuration file that later stores publishing tokens. This is legitimate packaging guidance, but it creates a real credential exposure risk if permissions or repository hygiene are weak.

Medium

resources/implementation-playbook.md:444

Hidden file access

# Create ~/.pypirc

The skill references writing a hidden configuration file in the user home directory. That access is intentional documentation, but it is security-sensitive because the file can contain package publishing credentials.

Risk Factors

🌐 Network access (14)

📁 Filesystem access (2)

resources/implementation-playbook.md:444 resources/implementation-playbook.md:444

⚙️ External commands (2)

SKILL.md:32 SKILL.md:36

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/sickn33-python-packaging/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/sickn33-python-packaging/security.svg)](https://skillstore.io/skills/sickn33-python-packaging?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/sickn33-python-packaging?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-python-packaging/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/sickn33-python-packaging.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

sickn33. (2026). python-packaging security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-python-packaging/audits/6

BibTeX citation

@techreport{sickn33-sickn33-python-packaging-2026,
  author = {sickn33},
  title = {python-packaging security audit report (audit version 6)},
  institution = {Skillstore},
  year = {2026},
  number = {6},
  url = {https://skillstore.io/skills/sickn33-python-packaging/audits/6},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "python-packaging security audit report (audit version 6)"
version: "unspecified"
type: report
authors:
  - name: "sickn33"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/sickn33-python-packaging/audits/6"
identifiers:
  - type: other
    value: "skillstore:sickn33-python-packaging:audit:6"
    description: "Skillstore immutable audit report identifier"

Compare variants

3 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Highest Skillstore Score

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

ActiveInferenceInstitute Recommended

activeinferenceinstitute-python-packaging

Skillstore Score 77

Evidence Confidence High

Skillstore usage 10

Updated

2026-08-21

wshobson

wshobson-python-packaging

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 13

Updated

2026-08-21

sickn33 Current

sickn33-python-packaging

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 10

Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Package a New Library

Create a clean source layout, project metadata, dependencies, and release checklist for a reusable Python library.

Ship a Command-Line Tool

Add entry points, choose a CLI pattern, and prepare installable distributions for a Python command-line application.

Standardize Internal Releases

Document build, TestPyPI, private index, and automation patterns for repeatable package releases.

Try These Prompts

Create a Package Skeleton

Use this skill to design a minimal Python package layout for my library. Include required files, metadata, and testing folders.

Convert a Script to a CLI Package

Use this skill to turn my Python script into an installable CLI package. Recommend entry points, dependencies, and release steps.

Prepare a PyPI Release

Use this skill to review my package for a PyPI release. Check metadata, build outputs, documentation, versioning, and TestPyPI validation.

Design a Team Packaging Workflow

Use this skill to design a repeatable packaging workflow for a team. Include private index use, CI publishing, tokens, and verification gates.

Best Practices

Use a src layout and pyproject.toml for new packages.
Build and test wheels in a clean environment before release.
Use scoped publishing tokens or trusted publishing, and keep credentials outside repositories.

Avoid

Copying placeholder metadata or URLs into a real package without review.
Publishing directly to PyPI before testing on TestPyPI or a clean install.
Storing long-lived repository tokens in shared files or committed configuration.

Frequently Asked Questions

Does this skill create package files automatically?

It gives instructions and templates. The AI assistant can apply them when you provide project files.

Does it support pyproject.toml?

Yes. The playbook focuses on modern pyproject.toml metadata, build systems, dependencies, and tool configuration.

Can it help with CLI tools?

Yes. It covers entry points and examples for Click and argparse based command-line packages.

Can it publish my package to PyPI?

It explains the release process, but publishing still requires your credentials, review, and explicit action.

Does it cover private package indexes?

Yes. It includes private index examples that should be adapted to your organization security policy.

Is this a replacement for PyPA documentation?

No. It is a practical guide for common workflows and should be checked against official PyPA guidance for edge cases.

Developer Details

Author

sickn33

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/python-packaging

Ref

3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88

Maintenance freshness

7/18/2026

Usage

8 downloads · 144 views

File structure

📁 resources/

📄 implementation-playbook.md

📄 SKILL.md