·
Last changedVersion:
This version passed the hardening gate. Hardening applied 2 targeted changes and preserved all other text. Classified findings before hardening: 8. Classified findings closed: 1. Classified findings remaining: 7. Unclassified scanner findings remaining: 0. Review findings closed: 2. Review findings remaining: 9.
1
7
7
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
references/details.md | Excessive Agency & Rogue Autonomy | — | Medium | Closed | |
references/advanced-patterns.md | Prompt Injection | Third-party content as instructions | Low | Open | |
references/details.md | Malicious Code & Command Execution | — | Low | Open | |
references/advanced-patterns.md | Supply Chain & Install-Time Trust | Dependency or plugin compromise | Low | Open | |
references/details.md | Prompt Injection | Third-party content as instructions | Low | Open | |
references/advanced-patterns.md | Malicious Code & Command Execution | — | Low | Open | |
references/advanced-patterns.md | Supply Chain & Install-Time Trust | Install-time download and execute | Low | Open | |
references/details.md | Supply Chain & Install-Time Trust | Install-time download and execute | Low | Open |
8 findings
Comprehensive guide to creating, structuring, and distributing Python packages using modern packaging tools, pyproject.toml, and publishing to PyPI.
src/package_name/ (recommended)package_name/ (simpler but less flexible)Advantages:
pyproject.toml for source layout:
Simpler but:
Detailed pattern documentation lives in references/details.md. Read that file when the navigation tier above is insufficient.
Get started with chainctlchainctl skill install public/wshobson/python-packaging:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/wshobson/plugins/python-development/skills/python-packaging:latest
MIT
HARDENING.md
LICENSE
SKILL.md
references/advanced-patterns.md
references/details.md