marketplace/bundles/pm-dev-python/skills/python-core/SKILL.md
Use when writing, reviewing, or refactoring Python 3.10+ code — covers type annotations, data structures, error handling, resource management, async patterns, naming conventions, and imports. Activate for any Python production code task. Also use when working with pathlib, dataclass, pydantic, match statements, or structural pattern matching, or when hardening untrusted input (secure subprocess, deserialization, eval, and SQL injection sinks).
npx skillsauth add cuioss/plan-marshall python-coreInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
REFERENCE MODE: This skill provides reference material for Python 3.10+ development. Load standards on-demand based on current task. Do not load all sections at once.
Execution mode: Reference library; load standards on-demand for Python development tasks.
Prohibited actions:
typing.List, typing.Dict, or other deprecated generic aliases; use built-in genericsexcept: or broad except Exception: without re-raisingpathlib.PathConstraints:
X | Y)Activate when:
File: standards/python-core.md (771 lines)
Load progressively by section based on current task. Never load the entire file at once.
| Section | Load When |
|---------|-----------|
| Type Annotations | Writing or reviewing type hints, choosing between built-in generics and collections.abc |
| Data Structures | Choosing between dataclass, attrs, pydantic, NamedTuple |
| Error Handling | Writing try/except blocks, custom exceptions, validation patterns |
| Resource Management | File I/O, context managers, custom resource cleanup |
| Path Handling | File path operations, pathlib.Path usage, path security |
| Security / injection | Validating untrusted input, running subprocesses, deserializing external data, building SQL (subprocess/shlex, pickle/yaml.safe_load, eval/ast.literal_eval, DB-API placeholders) |
| Async Programming | asyncio patterns, concurrency with gather(), rate limiting |
| Structural Pattern Matching | match statements, destructuring, class patterns, guard clauses |
| Modern Features (3.11-3.13) | Exception groups, @override, itertools.batched() |
| Functions and Classes | Function design, class composition, mutable defaults |
| Naming Conventions | Module/class/function/variable naming styles |
| Imports | Import organization, grouping, and rules |
| Docstrings | Google-style format for functions, classes, and modules |
| Comprehensions and Generators | List/dict comprehensions, generator expressions |
| String Handling | F-strings, multi-line strings, string building |
Load Command:
Read standards/python-core.md
| Topic | Rule |
|-------|------|
| Type hints | Built-in generics (list[str]), union syntax (X \| None), collections.abc for parameters |
| Data structures | dataclass (default), attrs (performance), pydantic (API boundaries) |
| Error handling | Specific exceptions only, minimal try scope, chain with from |
| Resources | Always context managers; pathlib.Path for all file/path operations |
| Security / injection | No shell=True/argv lists; yaml.safe_load not yaml.load; ast.literal_eval not eval; DB-API placeholders not f-strings |
| Pattern matching | match/case for structural destructuring; if/elif for simple comparisons |
| Async | asyncio.run() entry point, gather() for concurrency, Semaphore for rate limiting |
| Naming | lower_with_under (functions/modules), CapWords (classes), CAPS_WITH_UNDER (constants) |
| Docstrings | Google style with Args/Returns/Raises sections |
| Imports | Three groups (stdlib, third-party, local), sorted alphabetically |
pm-dev-python:pytest-testing - Testing standards with pytestpm-plugin-development:plugin-script-architecture - Standards for marketplace plugin scriptsdevelopment
Domain-owned OpenRewrite log-line finding parser for the java-cui domain — parses the
development
Domain-owned OpenRewrite marker detection for the java-cui domain — scans Java/Kotlin sources for cui-rewrite TODO markers, categorizes them by recipe, and fails the gate on any detected marker
development
Operator control surface for the marshalld build server — enrol/drop a project in the machine-global registry (the opt-in enable signal and anti-laundering wall), manage the daemon lifecycle (start, stop, drain, status, install, upgrade) version-pinned to the verified bundle copy, and inspect the daemon's per-project interaction-audit log (read-only)
tools
The tiny build-consumption client for the marshalld build server — submit a build job, bounded long-poll for its result, ping the daemon identity, and preflight registry-plus-liveness in one call; consumption only, never provisioning or enrolment