One line, index-strategy = "unsafe-best-match", next to a private index in pyproject.toml lets anyone who publishes your private package's name on PyPI with a higher version get their code installed on your machines and CI (dependency confusion). A token pasted into an index or git URL is readable by everyone with the repository, and a .python-version of 3.9 is past its end of life. This skill finds those and the other Python project config mistakes below, and tells you how to fix each one.

Your agent runs a scanner on pyproject.toml ([project], [dependency-groups], [build-system], [tool.uv], [tool.poetry], [tool.pdm], [tool.hatch]), uv.toml, poetry.toml, pdm.toml, hatch.toml, Pipfile, the lock files uv.lock, poetry.lock, pdm.lock, pylock.toml and Pipfile.lock, and .python-version. It parses TOML with line numbers and follows each tool's own index rules: uv's first-index strategy and explicit indexes, Poetry source priorities and source pins, PDM include_packages and respect-source-order, Pipenv index pins. It treats ${VAR} and {env:...} values as references, knows PyPI mirrors and public vendor indexes such as PyTorch, and looks for lock files next to each pyproject.toml and in a parent uv workspace. It never runs pip, uv, Poetry, PDM or Hatch and never contacts an index. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• P01: package indexes, find-links, sources, dependency URLs, index env-vars and lock-file URLs over plain http:// (a host on this machine is fine)
• P02: passwords and tokens in index, source and git URLs (also a token used as the URL's user name) or under credential keys (PDM password, Poetry http-basic and pypi-token in poetry.toml, secret-named Hatch env-vars and PDM script env)
• P03: TLS verification turned off: uv allow-insecure-host, verify_ssl = false (PDM, pdm.toml, Pipfile), Poetry certificates cert = false, PIP_TRUSTED_HOST, UV_INSECURE_HOST
• P04: an index that is not PyPI searched together with PyPI for unpinned packages: uv unsafe-best-match or unsafe-first-match with an index that is not explicit, PDM sources without include_packages, Poetry supplemental or several primary sources, PIP_EXTRA_INDEX_URL, Pipenv install_search_all_sources (pinning a few packages does not clear it)

REVIEW (check before release)

• P11: the same merged setups with a public vendor index (PyTorch, NVIDIA, PyG)
• P12: git dependencies on a branch or with no ref (branch = "main", @main, @feature-1.2, Pipfile ref = "main")
• P13: projects with dependencies managed by uv, Poetry or PDM applications and locked Hatch environments with no lock file, or a lock file ignored by .gitignore (a requirements file compiled by uv or pip-compile counts as a lock)
• P14: a .python-version that requires-python does not allow
• P15: a .python-version or Pipfile python_version past its end of life (3.9 ended 2025-10-31, 3.10 on 2026-10-01)
• P16: requires-python capped below Python 4 in a package (<3.13, ==3.11.*, Poetry ~3.10)
• P17: deprecated or removed settings: uv tool.uv.dev-dependencies and top-level index-url / extra-index-url, Poetry [tool.poetry.dev-dependencies] and the default / secondary source priorities

What's included

• The scanner (Python 3.9+, standard library only)
• A rules guide with the reason, safer approach and official source for each rule
• A risky and a safe example (a uv API project and a Poetry worker), and the real report the scanner produces on the risky one

Limits

It reads each file as written. User-level config (~/.config/uv/uv.toml, Poetry's config.toml and auth.toml, pip.conf), environment variables and CI settings are not read, and requirements.txt, setup.py and setup.cfg are not checked. An index strategy and the indexes it applies to are judged inside one file. Whether an index may hold private package names is decided from its host: PyPI, known PyPI mirrors and known public vendor indexes are recognized, and any other host counts as possibly private, so PDM's own docs example of a private source without include_packages is reported on purpose (PDM considers all sources equal by default). Lock-file contents are not compared with pyproject.toml. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 19 files: SKILL.md, the scanner in scripts/ (6 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (10 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.