66 skills · sorted by relevance
Turn Python code into installable libraries or command-line tools. The skill guides project structure, package metadata, dependency settings, building wheel and source archives, and publishing releases to PyPI or private package repositories.
Find npm and PyPI packages that imitate trusted package names to exploit typing mistakes. Compare spelling similarity, publication dates, downloads, and maintainer details, then rank suspicious candidates and produce reports or blocklists for further review.
Screen dependency names on npm, PyPI, and crates.io before installation to find lookalikes of legitimate packages. This skill compares spelling patterns and registry metadata, helping review AI-generated lists, lockfile changes, and new dependencies in CI/CD.
Install the CARLA Python client into a chosen Python environment using bundled packages or PyPI. The skill checks existing installations, selects a suitable package, and verifies imports and version compatibility with a reachable simulator.
Inspect Python and JavaScript dependency files for missing version constraints, duplicate entries, conflicting exact versions, and outdated Python compatibility packages. Get plain-language explanations and focused repair suggestions, with offline checks by default.
Generates professional PyPI-compliant README files in Markdown or reStructuredText. Use when creating a Python package README for PyPI publication, converting between README.md and README.rst formats, validating markup with twine check before publishing, configuring the readme field in pyproject.toml, integrating sphinx-readme to generate PyPI-compatible RST from Sphinx docs, troubleshooting rendering errors on PyPI, or previewing README rendering locally with grip or docutils.
The English summary is being prepared. Showing the original description.
Research existing solutions before implementing a feature. Search project code, package registries, agent tools, and GitHub, then compare functionality, maintenance, licensing, and dependencies to decide whether to adopt, extend, combine, or build.
Find dependency confusion risks, where a public package can replace an internal package with the same name. Review dependency files, identify exposed names, and guide registry restrictions and recurring CI checks to prevent substitution.
Prepare Python SDK releases by updating versions, package metadata, pinned dependencies, lockfiles, and build workflows. The skill covers release process changes and publication verification, helping agents handle packaging work within the repository’s release procedures.
Detects typosquatting attacks in npm and PyPI package registries by analyzing package name similarity using Levenshtein distance and other string metrics, examining publish date heuristics to identify recently created packages mimicking established ones, and flagging download count anomalies where suspicious packages have disproportionately low usage compared to their legitimate targets. The analyst queries the PyPI JSON API and npm registry API to gather package metadata for automated comparison. Activates for requests involving package typosquatting detection, dependency confusion analysis, malicious package identification, or software supply chain threat hunting in package registries.
The English summary is being prepared. Showing the original description.
Prepare and coordinate Octop Python package releases, including version updates, a Chinese changelog, and a pull request. After merging, GitHub Actions handles release tags, package and container publishing, and branch synchronization.
Audit npm, PyPI, and Go dependencies for version-specific advisories, inactive upstream projects, concentrated npm publishing rights, and installation scripts. Produce a report backed by collected data, with assessment coverage, action priorities, and upgrade or replacement guidance.
Assess dependency confusion, where a build retrieves a public package instead of an intended private one. Discover internal package names, review registry settings, plan callback-based proofs of execution, and document fixes across major package ecosystems.
Audit a Python project's installed dependencies for known CVEs by wrapping pip-audit (PyPA's official vulnerability auditor) and emitting findings in the canonical penetration-tester schema. Detects vulnerable direct AND transitive packages, normalizes pip-audit's severity output via OSV severity bands, falls back to pip list --outdated when pip-audit isn't installed, and supports requirements.txt, pyproject.toml (PEP 621), Pipfile.lock, and poetry.lock as input sources. Use when: pre-merge gate on a Python project, post-incident sweep after a PyPI compromise (e.g. ctx, request-toolbelt typosquats, ultralytics 8.3.42 compromise), SOC2 evidence collection, or inheriting an unfamiliar Python codebase. Threshold: any HIGH or CRITICAL CVE in the resolved dependency tree. MODERATE / LOW reported informationally. Trigger with: "audit python deps", "pip vulnerability scan", "check pypi packages for CVEs", "pip-audit run".
The English summary is being prepared. Showing the original description.
Configures CI/CD pipelines for automated Python package publishing to PyPI or GitLab Package Registry. Use when creating GitHub Actions or GitLab CI release workflows, setting up trusted publishing or API token-based PyPI authentication, configuring version management with git tags and hatch-vcs, writing pyproject.toml publishing metadata, testing packages against TestPyPI, or documenting the release process for a Python project.
The English summary is being prepared. Showing the original description.
End-to-end skill for building, testing, linting, versioning, and publishing a production-grade Python library to PyPI. Covers all four build backends (setuptools+setuptools_scm, hatchling, flit, poetry), PEP 440 versioning, semantic versioning, dynamic git-tag versioning, OOP/SOLID design, type hints (PEP 484/526/544/561), Trusted Publishing (OIDC), and the full PyPA packaging flow. Use for: creating Python packages, pip-installable SDKs, CLI tools, framework plugins, pyproject.toml setup, py.typed, setuptools_scm, semver, mypy, pre-commit, GitHub Actions CI/CD, or PyPI publishing.
The English summary is being prepared. Showing the original description.
End-to-end skill for building, testing, linting, versioning, and publishing a production-grade Python library to PyPI. Covers all four build backends (setuptools+setuptools_scm, hatchling, flit, poetry), PEP 440 versioning, semantic versioning, dynamic git-tag versioning, OOP/SOLID design, type hints (PEP 484/526/544/561), Trusted Publishing (OIDC), and the full PyPA packaging flow. Use for: creating Python packages, pip-installable SDKs, CLI tools, framework plugins, pyproject.toml setup, py.typed, setuptools_scm, semver, mypy, pre-commit, GitHub Actions CI/CD, or PyPI publishing.
The English summary is being prepared. Showing the original description.
Assess weaknesses in the software supply chain, from dependency packages to build pipelines and distributed artifacts. Covers authorized proof-of-concept testing, package confusion, container image risks, signing abuse, and defensive checks for tampering.
Python package creation and PyPI distribution via pyproject.toml and entry points. Use when publishing a package or setting up build configuration.
The English summary is being prepared. Showing the original description.
Detect and prevent public-over-private name resolution in npm, PyPI, and Maven.
The English summary is being prepared. Showing the original description.
Publish a released version of the Apache SkyWalking AI Sessionizer LangChain plugin, apache-skywalking-asz-langchain, to PyPI. Says what a release manager sets up before the first upload, downloads the voted source package, verifies it, builds the source distribution and the wheel from plugins/langchain inside it, checks and installs them, and uploads them with twine. Use after a version is published.
The English summary is being prepared. Showing the original description.
適切なプロジェクト構造、setup.py/pyproject.toml、PyPIへの公開を使用して配布可能なPythonパッケージを作成。Pythonライブラリのパッケージング、CLIツールの作成、Pythonコードの配布時に使用。
The English summary is being prepared. Showing the original description.
claude-org-runtime のリリース (release-* タスク / vX.Y.Z タグ発行) を、 同 PyPI 発行を受ける claude-org-ja 側の expectation 同期と ペアで設計・委譲・完了させるためのワークフロー。 DEFAULT_NOTIFY 値・classifier vocabulary・role_configs_schema (ja 側ミラー: org_extension_schema)・attention.example.json テンプレ等が 変わるリリースで発動する。 CI cascade を予測・予防し、ja-side の red を回避することを目的とする。
The English summary is being prepared. Showing the original description.
Store project files and conversation transcripts as searchable memories while preserving their original text. Retrieve past decisions, code, and notes by meaning, inspect stored content, and review how well memories are organized.