技能 python-venv-manager
📦

python-venv-manager

內容修訂 r1 嚴重 ⚙️ 外部命令🌐 網路存取📁 檔案系統存取🔑 環境變數

管理 Python 虛擬環境

Python 專案經常因為環境、版本和依賴項在不同機器間產生偏移而失敗。此技能為 Claude、Codex 和 Claude Code 提供結構化指引，用於建立可重現的 Python 設定。

支援: Claude Codex Code(CC)
Maintain this Skill? Claim it ⚠️ 38 差

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求
Review the Skillstore skill "python-venv-manager" from https://skillstore.io/skills/curiouslearner-python-venv-manager.md and its manifest at https://skillstore.io/api/skills/curiouslearner-python-venv-manager/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/curiouslearner-python-venv-manager.md 已簽名 manifest GET /api/skills/curiouslearner-python-venv-manager/manifest 已簽名 lockfile GET /api/skills/curiouslearner-python-venv-manager/lockfile

測試它

正在使用「python-venv-manager」。 使用 Poetry 設定新的 Python CLI 專案。

預期結果:

一份逐步設定計畫，涵蓋 Poetry 初始化、依賴項群組、pytest、格式化工具和驗證命令。

正在使用「python-venv-manager」。 我的匯入在本機可運作，但在 CI 中失敗。

預期結果:

  • 檢查 CI 使用哪個 Python 直譯器。
  • 確認虛擬環境已啟用。
  • 如果使用 src layout，請以 editable mode 安裝套件。
  • 在變更版本前執行依賴項檢查。

正在使用「python-venv-manager」。 將 requirements.txt 專案移至 locked workflow。

預期結果:

一份遷移大綱，會備份目前檔案、匯入依賴項、建立 lock file，並在乾淨環境中測試安裝。

安全審計

嚴重
v9 • 2026/7/9 開啟版本化報告

Most static findings are false positives caused by markdown code fences and normal Python environment documentation. Confirmed risks remain for remote installer commands piped into shells, shell expansion of dependency files, xargs-based package installation, and examples that create local .env files with secret-like values.

1
已掃描檔案
1,016
分析行數
16
複核項目
0
已忽略的誤報

已確認的安全問題 (3)

嚴重
SKILL.md:147
Pipe to shell pattern
curl https://pyenv.run | bash
The documented command pipes a remote pyenv installer directly into bash. This is a real supply-chain risk because downloaded code executes without inspection.
嚴重
SKILL.md:415
Pipe to shell pattern
curl https://pyenv.run | bash
The documented command pipes a remote pyenv installer directly into bash. This is a real supply-chain risk because downloaded code executes without inspection.
高
SKILL.md:652
Environment file access
cat > .env << EOF
The example creates a .env file that contains secret-like values. This is common setup guidance, but it can create sensitive local files if copied into a repository.
能力複核項目 (16)

這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。

高
SKILL.md:655
Database connection strings
DATABASE_URL=postgresql://user:pass@localhost/db
The example writes placeholder SECRET_KEY and DATABASE_URL values into a .env file. They are examples, but they normalize creating local secret files and need clear handling warnings.
高
SKILL.md:654
Generic API/secret keys
SECRET_KEY=your-secret-key
The example writes placeholder SECRET_KEY and DATABASE_URL values into a .env file. They are examples, but they normalize creating local secret files and need clear handling warnings.
中
SKILL.md:275
Shell command substitution
poetry add $(cat requirements.txt)
The command expands the full contents of requirements.txt into a package install command. Malformed or unexpected file contents could alter the install operation.
中
SKILL.md:420
Shell command substitution
eval "$(pyenv init -)"
The command evaluates shell output from pyenv initialization. This is a standard pyenv pattern, but eval of generated shell text is still a real execution risk if the tool is compromised.
中
SKILL.md:421
Shell command substitution
eval "$(pyenv virtualenv-init -)"
The command evaluates shell output from pyenv initialization. This is a standard pyenv pattern, but eval of generated shell text is still a real execution risk if the tool is compromised.
中
SKILL.md:831
Shell command substitution
pkg_name=$(echo $package | cut -d'=' -f1 | cut -d'>' -f1 | cut -d'<' -f1)
The migration script processes untrusted requirements lines through shell parsing. Package names are quoted later, but the loop still depends on shell handling of file content.
中
SKILL.md:854
Shell command substitution
poetry add $(pipenv requirements | sed 's/==/=/g')
The command substitution passes Pipenv output directly into poetry add. Unexpected dependency text could change arguments or install unintended packages.
中
SKILL.md:267-285
Template literal with command substitution
```bash
The surrounding bash block contains command substitution or shell evaluation patterns. These are legitimate examples, but they can execute unintended input if copied without review.
中
SKILL.md:413-447
Template literal with command substitution
```bash
The surrounding bash block contains command substitution or shell evaluation patterns. These are legitimate examples, but they can execute unintended input if copied without review.
中
SKILL.md:816-840
Template literal with command substitution
```bash
The surrounding bash block contains command substitution or shell evaluation patterns. These are legitimate examples, but they can execute unintended input if copied without review.
中
SKILL.md:843-855
Template literal with command substitution
```bash
The surrounding bash block contains command substitution or shell evaluation patterns. These are legitimate examples, but they can execute unintended input if copied without review.
中
SKILL.md:818
Unix shell invocation
#!/bin/bash
The skill includes a bash migration script. Script execution is expected for this domain, but it can modify dependency files and install packages.
中
SKILL.md:848
xargs command (can execute arbitrary commands)
cat requirements.txt | xargs poetry add
The command feeds requirements.txt entries directly through xargs into poetry add. Unreviewed dependency file contents could cause unintended package installation or argument changes.
低
SKILL.md:88
Hardcoded URL
curl -sSL https://install.python-poetry.org | python3 -
The Poetry installer is fetched remotely and piped to Python. This is a common install method but still executes downloaded installer code.
低
SKILL.md:147
Hardcoded URL
curl https://pyenv.run | bash
The URL is part of a remote installer command that is piped to bash. The network access is intentional, but it increases supply-chain exposure.
低
SKILL.md:415
Hardcoded URL
curl https://pyenv.run | bash
The URL is part of a remote installer command that is piped to bash. The network access is intentional, but it increases supply-chain exposure.

風險因素

⚙️ 外部命令 (50)
SKILL.md:47-65 SKILL.md:65-68 SKILL.md:68-80 SKILL.md:80-83 SKILL.md:83-115 SKILL.md:115-118 SKILL.md:118-139 SKILL.md:139-142 SKILL.md:142-167 SKILL.md:167-171 SKILL.md:171-178 SKILL.md:178-183 SKILL.md:183-224 SKILL.md:224-227 SKILL.md:227-264 SKILL.md:264-267 SKILL.md:267-285 SKILL.md:285-290 SKILL.md:290-314 SKILL.md:314-317 SKILL.md:317-339 SKILL.md:339-342 SKILL.md:342-373 SKILL.md:373-376 SKILL.md:376-408 SKILL.md:408-413 SKILL.md:413-447 SKILL.md:447-450 SKILL.md:450-471 SKILL.md:471-476 SKILL.md:476-486 SKILL.md:486-489 SKILL.md:489-511 SKILL.md:511-514 SKILL.md:514-545 SKILL.md:545-550 SKILL.md:550-568 SKILL.md:568-571 SKILL.md:571-588 SKILL.md:588-591 SKILL.md:591-605 SKILL.md:605-608 SKILL.md:608-618 SKILL.md:618-621 SKILL.md:621-630 SKILL.md:630-633 SKILL.md:633-642 SKILL.md:642-647 SKILL.md:647-668 SKILL.md:668-671
🌐 網路存取 (9)
SKILL.md:284 SKILL.md:88 SKILL.md:147 SKILL.md:350 SKILL.md:415 SKILL.md:782 SKILL.md:788 SKILL.md:794 SKILL.md:799
📁 檔案系統存取 (5)
SKILL.md:418 SKILL.md:916 SKILL.md:917 SKILL.md:918 SKILL.md:902
🔑 環境變數 (28)
SKILL.md:665 SKILL.md:666 SKILL.md:667 SKILL.md:678 SKILL.md:687 SKILL.md:702 SKILL.md:665 SKILL.md:666 SKILL.md:667 SKILL.md:678 SKILL.md:687 SKILL.md:702 SKILL.md:648 SKILL.md:649 SKILL.md:660 SKILL.md:663 SKILL.md:957 SKILL.md:660 SKILL.md:663 SKILL.md:655 SKILL.md:656 SKILL.md:667 SKILL.md:684 SKILL.md:687 SKILL.md:691 SKILL.md:654 SKILL.md:666 SKILL.md:678

偵測到的模式

Pipe to shell pattern×2
審計單位: claude 檢視審計紀錄 →
分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告
安全評估

複製報告連結

https://skillstore.io/skills/curiouslearner-python-venv-manager/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/curiouslearner-python-venv-manager/security.svg)](https://skillstore.io/skills/curiouslearner-python-venv-manager?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/curiouslearner-python-venv-manager?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/curiouslearner-python-venv-manager/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/curiouslearner-python-venv-manager.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
學術引用 (APA · BibTeX · CFF)

APA 引用

CuriousLearner. (2026). python-venv-manager security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/curiouslearner-python-venv-manager/audits/9

BibTeX 引用

@techreport{curiouslearner-curiouslearner-python-venv-manager-2026, author = {CuriousLearner}, title = {python-venv-manager security audit report (audit version 9)}, institution = {Skillstore}, year = {2026}, number = {9}, url = {https://skillstore.io/skills/curiouslearner-python-venv-manager/audits/9}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "python-venv-manager security audit report (audit version 9)" version: "unspecified" type: report authors: - name: "CuriousLearner" date-released: "2026-07-09" url: "https://skillstore.io/skills/curiouslearner-python-venv-manager/audits/9" identifiers: - type: other value: "skillstore:curiouslearner-python-venv-manager:audit:9" description: "Skillstore immutable audit report identifier"

Skillstore 評分

評分依據 證據置信度: 中
55
架構
85
可維護性
87
內容
72
社群
70
規範符合度

你可以打造什麼

啟動乾淨的 Python 專案

建立具備虛擬環境、依賴項、測試和格式化工具的可重現專案結構。

標準化團隊環境

在 Poetry、pip-tools、Pipenv 和 pyenv 之間選擇，以便在團隊中維持一致的開發設定。

疑難排解依賴項問題

診斷匯入錯誤、套件衝突、SSL 憑證失敗和損壞的虛擬環境。

試試這些提示

建立基本虛擬環境 
使用 python-venv-manager 向我展示建立虛擬環境、啟用它、安裝套件，以及儲存依賴項的最安全步驟。
選擇依賴項工具 
使用 python-venv-manager 為我的 Python web service 比較 venv、Poetry、Pipenv 和 pip-tools。推薦一種方法並說明權衡取捨。
修正依賴項衝突 
使用 python-venv-manager 協助偵錯我的 Python 依賴項衝突。詢問你需要的套件檔案，然後提出安全的命令來檢查並解決問題。
規劃 Poetry 遷移 
使用 python-venv-manager 為既有應用程式規劃從 requirements.txt 遷移到 Poetry。包含驗證步驟和 rollback 考量。

最佳實務

  • 執行安裝程式命令前先審查它們，尤其是使用 curl 下載的命令。
  • 針對 production 部署使用 lock files 或 hashed requirements。
  • 合併依賴項更新前，先在乾淨的虛擬環境中測試。

避免

  • 不要在未檢查的情況下，將遠端安裝 scripts 直接 pipe 到 shell。
  • 不要將專案依賴項安裝到全域 Python 環境。
  • 不要 commit .env 檔案、虛擬環境或產生的快取目錄。

常見問題

這項技能會自動建立虛擬環境嗎？
不會。它提供指引和命令範例，agent 或使用者可在審查後執行。
它涵蓋哪些工具？
它涵蓋 venv、virtualenv、Poetry、Pipenv、pyenv、pip-tools、pytest、pre-commit 和 Docker 範例。
它適合 production 專案安全使用嗎？
僅將它作為指引使用。審查所有命令、pin 依賴項，並避免在 production workflows 中使用遠端 shell 安裝程式。
它能修正依賴項衝突嗎？
它可以建議診斷和解決步驟，但需要專案檔案和測試結果才能準確修正。
它支援 Claude Code 嗎？
可以。報告標示它相容於 Claude、Codex 和 Claude Code。
使用前我應該審查什麼？
請審查會安裝套件、修改 shell 設定、建立 .env 檔案，或將依賴項清單讀入 shell 命令的命令。

開發者詳細資訊

授權

MIT

Skillstore 修訂

r1

版本提示

作者未聲明版本。

儲存庫

https://github.com/CuriousLearner/devkit/tree/main/skills/python-venv-manager

引用

7db9b9f06e0ab79c575b58bc48c4d8dc9849f424

維護新鮮度

2026/7/18

使用量

5 次下載 · 339 次瀏覽

檔案結構

📄 SKILL.md

CuriousLearner 的更多技能

查看全部

相關技能

查看全部