modern-python skill from Trail of Bits: uv, ruff and ty for Python projects

• Script, new project, library or migration

  Single-file script: PEP 723 inline metadata. New multi-file project: minimal uv setup. Reusable package: full setup. Existing project: migration guide.

  Try: “Set up a new Python package here with uv, ruff and ty, and add a pytest config.”

  Read · Decision tree

• uv init, dependency groups, pyproject.toml, Makefile

  Creates a src/ layout project, configures ruff with select ALL, ty strict rules and pytest coverage of 80 percent, and adds a Makefile. It asks first whether you want the Trail of Bits cookiecutter template.

  Runs code · Quick start and full setup

• From requirements.txt, setup.py, flake8/black/isort, mypy/pyright

  Converts to uv and pyproject.toml, removes the old tools, and deletes old files such as requirements.txt and the virtual environment folder when you ask for a migration.

  Delete · Migration guide

• 10 things to avoid and what to use instead

  For example uv add instead of uv pip install or editing pyproject.toml by hand, uv run instead of activating a venv, and prek instead of pre-commit.

  Read · Anti-patterns table

• shellcheck, detect-secrets, actionlint, zizmor, pip-audit, Dependabot

  Set up through prek hooks and CI. security-setup.md shows how to install them.

  Runs code · Security tools

• pyproject, uv commands, ruff, testing, PEP 723, prek, security, Dependabot, migration

  Loaded on demand for details.

  Read · 9 reference files

• Blocks bare python, pip and pipx in the agent shell

  Only in the plugin route. Prepends PATH shims that print the uv alternative and exit with an error.

  Runs code · Plugin hook: legacy command interception

Watch out for

• The plugin hook changes PATH for your assistant

  On SessionStart, hooks.json runs setup-shims.sh. If uv is installed and CLAUDE_ENV_FILE is set, it appends an export PATH line to that file, so 6 shims (python, python3, pip, pip3, pipx, uv) sit first on PATH for every command your assistant runs. Bare python or python script.py, python -m pip, pip, pip3, pipx and uv pip fail with a uv suggestion. python -c, python -, python -m <module> (other than pip) and uv pip with --project, --directory or --target pass through to the real tool. github.com

• Migration deletes files in your project

  The migration guide tells the assistant to delete requirements.txt, setup.py, setup.cfg and the venv folder. Commit first and review the diff. github.com

• It installs tools with downloaded scripts

  security-setup.md shows brew install, cargo install and a curl installer piped to sh for prek, plus uv tool install for detect-secrets and zizmor. prek.md shows prek install, which sets up git hooks, and rm -rf ~/.cache/pre-commit. github.com

• It can run a cookiecutter from GitHub

  For a new project it asks first, then can run uvx cookiecutter gh:trailofbits/cookiecutter-python. github.com

• The command table lists uv publish

  The uv quick reference includes uv publish, which uploads a package to PyPI. SKILL.md gives it only as a reference line. github.com