Source: trailofbits/skills · Maintainer: community: Trail of Bits · License: CC-BY-SA-4.0 · Checked: 24 October 2026
What is the modern-python skill?
The modern-python skill is a Trail of Bits Agent Skill that makes your coding agent set up and maintain Python projects with uv, ruff, ty, pytest and prek instead of pip, virtualenv, black, flake8 or mypy. It covers new projects, single-file scripts and migrations from older tooling.
Its SKILL.md description reads: "Configures Python projects with modern tooling (uv, ruff, ty). Use when creating projects, writing standalone scripts, or migrating from pip/Poetry/mypy/black."
The plugin README credits William Tan as author and says it is "Based on patterns from trailofbits/cookiecutter-python." As of 24 October 2026, its skills.sh page listed 8.7K installs (snapshot, 24 October 2026).
What does it do?
The skill gives the agent a decision tree. A single-file script with dependencies gets PEP 723 inline metadata. A new multi-file project that won't be distributed gets a minimal uv setup. A reusable package gets the full setup. An existing project goes to the migration guide.
The tool set. From the SKILL.md:
| Tool | Purpose | Replaces |
|---|---|---|
| uv | Package and dependency management | pip, virtualenv, pip-tools, pipx, pyenv |
| ruff | Linting and formatting | flake8, black, isort, pyupgrade, pydocstyle |
| ty | Type checking | mypy, pyright |
| pytest | Testing with coverage | unittest |
| prek | Pre-commit hooks | pre-commit |
It adds a security layer: shellcheck, detect-secrets, actionlint and zizmor in pre-commit, pip-audit for dependency scanning, and Dependabot for scheduled updates.
Anti-patterns. The skill has a table of things to avoid. Among them: uv pip install (use uv add and uv sync), hand-editing pyproject.toml to add dependencies (use uv add or uv remove), requirements.txt (PEP 723 for scripts, pyproject.toml for projects), [project.optional-dependencies] for dev tools (use [dependency-groups] from PEP 735), activating .venv by hand (use uv run), and the hatchling build backend (use uv_build).
The full setup. For a new package, the agent first asks whether you want to bootstrap from the Trail of Bits cookiecutter template with uvx cookiecutter gh:trailofbits/cookiecutter-python. Otherwise it runs uv init --package, writes a pyproject.toml with requires-python = ">=3.11", dependency groups for lint, test and audit, ruff with select = ["ALL"] and a short ignore list, an 80% coverage floor, and strict ty settings. It adds a Makefile with dev, lint, format, test and build targets.
Migrations. There are step lists for moving from requirements.txt and pip, from setup.py or setup.cfg, from flake8, black and isort, and from mypy or pyright. Dependencies are added one by one with uv add rather than pasted into pyproject.toml, old config files are deleted, and uv.lock goes into version control.
Folder contents. Besides SKILL.md, the skill has nine reference files (dependabot, migration checklist, PEP 723 scripts, prek, pyproject, ruff config, security setup, testing, uv commands), two templates (dependabot.yml and pre-commit-config.yaml) and Codex display metadata. The Dependabot template sets a 7-day cooldown on new releases, which the reference describes as supply chain protection.
How do you install it?
The Trail of Bits README covers Claude Code and Codex. The route you pick decides whether you get the hook.
Claude Code plugin (skill plus hook). Add the trailofbits marketplace and install the plugin in the standard plugin@marketplace form from the Claude Code plugin docs, or run /plugin to browse:
/plugin marketplace add trailofbits/skills
/plugin install modern-python@trailofbits
This brings a SessionStart hook that puts PATH shims in front of python, pip, pipx and uv. A bare pip install pkg prints uv add pkg or uv run --with pkg and fails; pipx run <pkg> points to uvx <pkg>. Commands such as python -c, python -m <module> and uv pip with --project, --directory or --target pass through, because redirecting them broke real tooling.
Codex. From the README:
codex plugin marketplace add trailofbits/skills
codex plugin add modern-python@trailofbits
Just the skill folder. The skills CLI command shown on skills.sh:
npx skills add https://github.com/trailofbits/skills --skill modern-python
For Claude Code, this installs only the skill folder to .claude/skills/modern-python/, or ~/.claude/skills/modern-python/ with -g, the standard Claude Code skill locations. The hook lives in the plugin's hooks/ folder, outside the skill folder, so going by the repo layout this route should not include it. See Codex skills and Cursor skills for other agents.
How do you use it?
Ask for Python setup or cleanup in plain words. Example prompts (suggestions, not quotes from the repo):
Create a new Python package called invoicer with uv, ruff, ty and pytest, set up the way this skill recommends.Turn scripts/fetch_rates.py into a single-file script with PEP 723 metadata so it runs with uv.Migrate this project from requirements.txt and pip to uv. Show me each package before adding it.Replace black, isort and flake8 with ruff and fix whatever the new rules flag.Add pip-audit, detect-secrets and zizmor to this repo, plus a Dependabot config.
You need uv installed. The tools themselves come in as dev dependencies through uv add --group dev.
Tips and limits
- It respects your choices. The skill says to keep legacy tooling if you explicitly ask, and to migrate only "when user requests it."
- Python 3.11 or later. Projects that need an older Python are listed under when not to use it.
select = ["ALL"]is strict. Turning on every ruff rule in an existing codebase can produce a long list of findings; the skill pairs it with explicit ignores.- The hook affects subprocesses. The README notes the shims "see every subprocess a tool spawns, not only what Claude types," which is why the intercepted set is narrow. If a tool you rely on breaks, the pass-through list in the plugin README is the place to check.
- Template and tools move fast. The skill encodes one set of current choices from Trail of Bits. Check each tool's own docs when a flag or config key doesn't behave as described.
- Audits. On 24 October 2026, skills.sh showed Pass from Gen Agent Trust Hub, Socket and Snyk.
- License. CC-BY-SA-4.0 allows copies and changes with attribution, and changed versions you share must use the same license.
Save it in your Kipt library
In Kipt, open Skills and paste the skill's GitHub folder link into the import box. Kipt reads the SKILL.md with its references/ and templates/ files; for a repo with many skills it shows a list, so you can add property-based-testing too. You can also drop the folder or a .zip. Your skills live in your own private GitHub repo and install into Claude Code or Codex with one command:
npx skills add https://github.com/<you>/<repo>.git --all -g
That installs the skill folder, not the plugin's hook. Keep the CC-BY-SA notice with any copy you change. Kipt is not affiliated with Trail of Bits.
Similar skills
- Property-based testing skill: Trail of Bits' skill for Hypothesis suites, which slot into the pytest setup here.
- Semgrep skill: Trail of Bits' static analysis skill for security checks beyond linting.
- GitHub Actions skill: workflow templates for running these checks in CI.
- Dockerfile skill: for packaging the project once it builds.