Python service kit

Verified

Python agents love to invent a toolchain. They pick pip when you use uv, unittest when you use pytest, and a schema that will hurt at 10 million rows. This kit pins the tools and the checks.

Who it is for

Someone shipping a Python service, often with Postgres. API, worker, or both.

What this combination solves

Trail of Bits sets the Python tools, property tests, and static analysis. OpenAI’s security skill is the baseline pass. Supabase’s Postgres skill keeps the schema honest. Superpowers debugging and verification stop the agent from declaring victory on a red test run.

Skills

  • Modern Python: uv, ruff, ty, pytest. Not a mix of 2018 defaults.
  • Property-based testing: properties, not one happy-path example.
  • Static analysis: CodeQL, Semgrep, SARIF on the change.
  • Security best practices: the pass I want on every agent-written diff.
  • Postgres best practices: indexes, types, and queries that will survive load.
  • Systematic debugging: cause first, then the patch.
  • Verification before completion: show the test output.

AGENTS.md starter

# AGENTS.md

Python service. Read this first.

## Commands

| Task | Command |
|------|---------|
| Install | `uv sync` |
| Test | `uv run pytest` |
| Lint | `uv run ruff check` |

## Hard rules

1. Use uv, ruff, ty, pytest. Do not add pip or unittest.
2. New behavior needs a property or a regression test, not a screenshot.
3. Run static analysis on security-sensitive changes.
4. Follow postgres-best-practices for schema and queries.
5. Do not say done without the command output.

## Skills

modern-python, property-based-testing, static-analysis,
security-best-practices, postgres-best-practices,
systematic-debugging, verification-before-completion.

Verification hook

Fail the session if uv run pytest or uv run ruff check fails. See Verification loops.

Install

One command per source repo. --skill picks names. -a claude-code, -a cursor, or -a codex targets one agent. Flags checked against the skills CLI README.

npx skills add trailofbits/skills --skill modern-python --skill property-based-testing --skill static-analysis

Requires Node.js 18+.

npx skills add openai/skills --skill security-best-practices

Requires Node.js 18+.

npx skills add supabase/agent-skills --skill postgres-best-practices

Requires Node.js 18+.

npx skills add obra/superpowers --skill systematic-debugging --skill verification-before-completion

Requires Node.js 18+.

Skills in this kit