Skip to content
Back to skills

Python Conventions

ASecurity

Python code conventions covering type hints, Ruff formatting/linting, mypy/pyright, pytest, async I/O, uv packaging, and dependency security scanning. Load when writing or reviewing Python code.

  • 146 stars
  • 0 votes
  • 0 copies
  • 0 views
  • Added October 5, 2026
ai-agentspythongotestingapibackendsecurity

Works with

  • api

Security analysis

A100/100

Scanned October 5, 2026

npx -y skills add Goldziher/ai-rulez --skill python-conventions --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Python Conventions?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Python Conventions
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/goldziher-python-conventions/badge)](https://www.skillsdirectory.com/skills/goldziher-python-conventions)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: python-conventions
description: Python code conventions covering type hints, Ruff formatting/linting, mypy/pyright, pytest, async I/O, uv packaging, and dependency security scanning. Load when writing or reviewing Python code.
---

- Python 3.10+, type hints on all public APIs, avoid `Any` — use precise types, generics, or `typing.Protocol`.
- Formatting/linting: a fast linter/formatter (e.g., Ruff), zero warnings; strict static type checking (e.g., mypy or pyright). Security: a SAST tool (e.g., Bandit).
- Testing: `pytest` with function-based tests, `pytest-cov` (80%+), `hypothesis` for property-based.
- Error handling: specific exceptions only, never bare `except:`, `contextlib.suppress` for intentional ignoring.
- Dataclasses or Pydantic for structured data — avoid raw dicts for known schemas.
- `pathlib.Path` over `os.path` for filesystem operations. Google-style docstrings on public APIs.
- Async: `async`/`await` for I/O, never mix blocking and async, `asyncio.gather()` for concurrency.
- Package management: a fast, lockfile-based package manager (e.g., uv) with the lockfile committed, build with a PEP 517 backend (e.g., maturin or hatchling).
- Security: `pip-audit` for dependency CVE scanning. Zero tolerance for critical/high vulnerabilities.
- Logging: structured logging (key=value / JSON) — never f-strings in log calls.
- Pattern matching (`match`/`case`) for multi-branch type dispatch (3.10+).
- Anti-patterns: mutable default args, `import *`, global state, `time.sleep` in async.

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…