mirror of https://github.com/trailofbits/skills.git synced 2026-09-14 14:28:48 +08:00

Files

T

History

William Tan 3b316e6ac7 fix(modern-python): suggest exact uv run python so shim advice works outside projects (#196 )

* fix(modern-python): suggest exact `uv run python` so the advice works outside projects

The python/python3 shim suggested `uv run $cmd ...`, echoing back whichever
name was invoked. For `python3` that advice is self-defeating on machines
with no uv-managed interpreters: uv resolves the `python3` command through
an ordinary PATH lookup, which hits the shim again and fails with the same
suggestion. uv special-cases the exact command name `python` (uv >= 0.4.0)
and executes its resolved interpreter directly, so always suggesting
`uv run python ...` works everywhere.

Reproduced on stock Debian + uv 0.11.27 (apt python3, zero managed
pythons, no project): `uv run python3 script.py` fails via the shim while
`uv run python script.py` succeeds, across script/-c/-m/REPL forms.

Reported in #195.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(modern-python): satisfy shellcheck SC2016 in new bats assertions

Escaped backticks in double quotes instead of literal backticks in
single quotes, which shellcheck flags as a possible unintended
non-expansion.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(modern-python): requote shim suggestions and carry all arguments through

Review findings on #196: the -m branch interpolated only the module name,
so `python -m http.server 8000` suggested a command missing the port, and
`${*}` flattened arguments without quoting, so `python -c 'print(1+1)'`
suggested a command that is a bash syntax error if run verbatim (plus a
trailing space inside the backticks for bare invocations). Both branches
now build the suggestion from %q-requoted arguments, with regression tests
for each case.

Also consolidates the exact-`python` rationale into a single canonical
copy in the shim's header comment; README, setup-shims.sh, and the bats
file now point there instead of paraphrasing it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

2026-07-29 15:16:05 -04:00

.claude-plugin

fix(modern-python): suggest exact uv run python so shim advice works outside projects (#196 )

2026-07-29 15:16:05 -04:00

hooks

fix(modern-python): suggest exact uv run python so shim advice works outside projects (#196 )

2026-07-29 15:16:05 -04:00

skills/modern-python

feat(codex): add UI metadata for skills (#175 )

2026-06-05 12:28:41 -04:00

README.md

fix(modern-python): suggest exact uv run python so shim advice works outside projects (#196 )

2026-07-29 15:16:05 -04:00

README.md

Modern Python

Modern Python tooling and best practices using uv, ruff, ty, and pytest. Based on patterns from trailofbits/cookiecutter-python.

Author: William Tan

When to Use

Setting up a new Python project with modern, fast tooling
Replacing pip/virtualenv with uv for faster dependency management
Replacing flake8/black/isort with ruff for unified linting and formatting
Replacing mypy with ty for faster type checking
Adding pre-commit hooks and security scanning to an existing project

What It Covers

Core Tools:

uv - Package/dependency management (replaces pip, virtualenv, pip-tools, pipx, pyenv)
ruff - Linting and formatting (replaces flake8, black, isort, pyupgrade)
ty - Type checking (replaces mypy, pyright)
pytest - Testing with coverage enforcement
prek - Pre-commit hooks (replaces pre-commit)

Security Tools:

shellcheck - Shell script linting
detect-secrets - Secret detection in commits
actionlint - GitHub Actions syntax validation
zizmor - GitHub Actions security audit
pip-audit - Dependency vulnerability scanning
Dependabot - Automated dependency updates with supply chain protection

Standards:

pyproject.toml - Single configuration file with dependency groups (PEP 735)
PEP 723 - Inline script metadata for single-file scripts
src/ layout - Standard package structure
Python 3.11+ - Minimum version requirement

Hook: Legacy Command Interception

This plugin includes a SessionStart hook that prepends PATH shims for python, pip, pipx, and uv. When Claude runs a bare python, pip, or pipx command, the shell resolves to the shim, which prints an error with the correct uv alternative and exits non-zero. The suggested alternative always uses the exact command name python (never python3) so it also works outside a project; see the header comment in hooks/shims/python for the full rationale.

Intercepted Command	Suggested Alternative
`python ...`	`uv run python ...`
`python -m module`	`uv run python -m module`
`python -m pip`	`uv add`/`uv remove`
`pip install pkg`	`uv add pkg` or `uv run --with pkg`
`pip uninstall pkg`	`uv remove pkg`
`pip freeze`	`uv export`
`uv pip ...`	`uv add`/`uv remove`/`uv sync`
`pipx install <pkg>`	`uv tool install <pkg>`
`pipx run <pkg>`	`uvx <pkg>`
`pipx uninstall <pkg>`	`uv tool uninstall <pkg>`
`pipx upgrade <pkg>`	`uv tool upgrade <pkg>`
`pipx upgrade-all`	`uv tool upgrade --all`
`pipx ensurepath`	`uv tool update-shell`
`pipx inject <pkg> <dep>`	`uv tool install --with <dep> <pkg>`
`pipx list`	`uv tool list`

Commands like grep python, which python, and cat python.txt work normally because python is a shell argument, not the command being invoked.

Installation

/plugin install trailofbits/skills/plugins/modern-python