helpers/skills/python-packaging-complexity/SKILL.md
Use this skill to analyze Python package build complexity by inspecting PyPI metadata. Evaluates compilation requirements, dependencies, distribution types, and provides recommendations for wheel building strategies.
npx skillsauth add opendatahub-io/ai-helpers python-packaging-complexityInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
This skill helps you evaluate the build complexity of Python packages by analyzing their PyPI metadata. It determines whether a package likely requires compilation, assesses build complexity, and provides recommendations for wheel building strategies.
When a user asks about Python package build complexity, building wheels, or evaluating PyPI packages for compilation requirements:
Run the PyPI inspection script using the package name and optional version:
./scripts/pypi_inspect.py <package_name> [version]
Analyze the output and provide interpretation focusing on:
Provide actionable recommendations:
./scripts/pypi_inspect.py torch
Interpretation: Analyze latest PyTorch version for build complexity, focusing on CUDA dependencies and compilation requirements.
./scripts/pypi_inspect.py numpy 1.24.3
Interpretation: Evaluate specific numpy version, explaining why numpy requires compilation and what build tools are needed.
./scripts/pypi_inspect.py tensorflow --json
Interpretation: Get structured data for programmatic analysis, then explain the complexity factors in plain language.
Based on the analysis, provide specific guidance:
If the script fails or package is not found:
This skill works best when combined with:
development
Run hexora static analysis on a Python package repository to detect suspicious code patterns, then triage findings with deterministic rules and AI reasoning to produce a structured risk report section.
development
Inspect recent git history of a Python package repository for suspicious commits touching supply-chain-sensitive files, then triage findings with AI reasoning to produce a structured risk report section.
development
Scan a Python package repository for compiled/binary files using Fromager-style detection and malcontent YARA analysis, then triage findings with deterministic rules and AI reasoning to produce a structured risk report section.
testing
Use this skill to identify non-Red Hat RPM packages installed in container images or on the local machine. For containers, pulls images across multiple architectures and release tags; for local scans, inspects the host directly. Extracts RPM signing metadata and reports packages not signed with the Red Hat GPG key as CSV output. Use when auditing compliance, checking supply-chain provenance, or scanning for third-party RPMs in RHOAI component images.