Agent skill · security · aradotso
pypi-security-best-practices
Guide for implementing security best practices when using Python packages from PyPI with uv and pip
Why this skill is useful
Provides specific commands and practices for securing Python package installations that the AI wouldn't reliably generate on its own.
What it needs
Requires pip, pip-audit, uv installed locally. About 9k tokens when loaded. Last updated 2026-08-04. 11 stars on the source repository.
What this skill does
PyPI Security Best Practices Skill by ara.so — Security Skills collection. This skill provides comprehensive guidance on securing Python package installations from PyPI, covering supply chain attack mitigation, dependency verification, and secure development practices for both uv and pip package managers. Overview PyPI security best practices help protect against supply chain attacks like the LiteLLM/Telnyx incident (119k+ malicious downloads in under 3 hours) and other compromised package scenarios. This guide covers secure package installation, dependency management, and development environment hardening. Key Security Principles: Prefer binary-only installations to avoid arbitrary code execution Implement dependency cooldowns to avoid newly-published malicious packages Pin dependencies with cryptographic hash verification Use deterministic installations and prevent dependency confusion Scan for vulnerabilities and verify package health Installation uv (Recommended) pip Security Tools Core Security Practices 1. Binary-Only Installations Source distributions can execute arbitrary code via setup.py. Enforce binary-only installs: With uv: With pip: 2. Dependency Cooldowns Avoid newly-published malicious packages by excluding recent releases: With uv: Per-package overrides: With pip (v26.1+): Dependabot cooldown: Renovate cooldown: 3. Hash Verification Always verify package integrity with cryptographic hashes: With uv (automatic in lockfile): Example lockfile entry: With pip: Example requirements.txt with hashes: 4. Deterministic Installations Use lockfiles for reproducible builds: With uv: With pip: 5. Prevent Dependency Confusion Configure package sources to prevent private/public namespace collisions: With uv: With pip: 6. Vulnerability Scanning Regularly scan dependencies for known vulnerabilities: With pip-audit: With uv-secure: In CI/CD (GitHub Actions): 7. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aradotso/pypi-security-best-practices