python-foundational

Foundational Python best practices, idioms, and code quality fundamentals - Brought to you by microsoft/hve-core

909 stars

Best use case

python-foundational is best used when you need a repeatable AI agent workflow instead of a one-off prompt.

Foundational Python best practices, idioms, and code quality fundamentals - Brought to you by microsoft/hve-core

Teams using python-foundational should expect a more consistent output, faster repeated execution, less prompt rewriting.

When to use this skill

  • You want a reusable workflow that can be run more than once with consistent structure.

When not to use this skill

  • You only need a quick one-off answer and do not need a reusable workflow.
  • You cannot install or maintain the underlying files, dependencies, or repository context.

Installation

Claude Code / Cursor / Codex

$curl -o ~/.claude/skills/python-foundational/SKILL.md --create-dirs "https://raw.githubusercontent.com/microsoft/hve-core/main/.github/skills/coding-standards/python-foundational/SKILL.md"

Manual Installation

  1. Download SKILL.md from GitHub
  2. Place it in .claude/skills/python-foundational/SKILL.md inside your project
  3. Restart your AI agent — it will auto-discover the skill

How python-foundational Compares

Feature / Agentpython-foundationalStandard Approach
Platform SupportNot specifiedLimited / Varies
Context Awareness High Baseline
Installation ComplexityUnknownN/A

Frequently Asked Questions

What does this skill do?

Foundational Python best practices, idioms, and code quality fundamentals - Brought to you by microsoft/hve-core

Where can I find the source code?

You can find the source code on GitHub using the link provided at the top of the page.

Related Guides

SKILL.md Source

# Python Foundational Coding Standards Skill

## Overview

Foundational Python excellence that every diff must satisfy. This skill is loaded first for any .py change. All higher-order skills build on it.

This content is a skill rather than an instructions file for three reasons: skills are distributed through the CLI plugin and VS Code extension without requiring consumers to copy files into their repo; new language skills can be added without modifying the review agent itself; and skills are loaded on demand, keeping the context window small when the diff contains no Python.

## Core Checklist

#### 1. Readability & Style

* Use Python naming: `PascalCase` classes, `snake_case` functions/variables, `UPPER_SNAKE_CASE` constants, `_` private members.
* Group imports: stdlib → third-party → local (blank line between groups, no trailing whitespace).

#### 2. Pythonic Idioms

* Prefer comprehensions for simple transforms; use explicit loops for complex logic/side-effects.
* Always use `with` for files, locks, DB connections.
* Prefer `dataclass` / `NamedTuple` / `Enum` for data holders.
* Use `pathlib` over `os.path`; timezone-aware `datetime` when relevant.
* Use `*` keyword-only arguments for multi-optional functions.
* Never use mutable defaults or `global`/`nonlocal` unless strictly required.

#### 3. Function & Class Design

* Keep functions small and single-responsibility.
* Add docstrings to all public APIs (follow repo style).
* Document unavoidable side-effects.
* Follow codebase’s class-member ordering (if defined).

#### 4. Type Safety Foundations

* Add type hints to all public APIs, module vars, and class attributes.
* Use PEP 695 (3.12+) or `TypeVar` for generics.
* Avoid `Any` except in thin wrappers.

#### 5. Error Handling

* Raise specific exceptions; never bare `except:` (broad `except Exception:` only at app boundaries with logging).
* No silent failures or generic error messages.
* Provide context, expected state, and guidance in every exception.

#### 6. Anti-Patterns to Avoid

* Never use `eval`, `exec`, or `pickle` on untrusted data.
* Never hard-code secrets.

#### 7. Maintainability

* Prefer self-documenting code; comments only for "why".
* Use structured logging instead of `print`.
* Flag overly long/complex functions that resist testing.

#### 8. Architectural Fit

* Align with existing patterns; do not re-implement shared functionality or bypass established layers.
* Place code in the correct module/package.

#### 9. Design Principles

* Eliminate duplication: extract repeated logic into a shared helper so fixes propagate automatically.
* Prefer the simplest implementation that satisfies current requirements. Introduce abstractions only when a second concrete use case appears.
* Limit change breadth: every modified line should trace to the stated purpose of the change.
* Before flagging seemingly unused code, verify it is not a protocol implementation, framework hook, public API, or entry point invoked externally.
* Match solution complexity to problem complexity. A duplicated function warrants a shared helper, not an event-driven architecture.

## References

| File                                                        | Covers       | Purpose                                                                                 |
|-------------------------------------------------------------|--------------|-----------------------------------------------------------------------------------------|
| [design-principles.md](references/design-principles.md)     | Section 9    | Rationale and examples for the design principles                                        |
| [code-style-patterns.md](references/code-style-patterns.md) | Sections 1–5 | Concrete code examples for style, idioms, type safety, class design, and error handling |

## Severity Rubric

| Severity | Definition                                                                                               |
|----------|----------------------------------------------------------------------------------------------------------|
| High     | Causes incorrect behavior, data loss, or security exposure at runtime                                    |
| Medium   | Degrades maintainability, readability, or violates a project convention with no immediate runtime impact |
| Low      | Cosmetic, stylistic, or minor improvement opportunity                                                    |

## Troubleshooting

| Symptom                      | Check                                                                                                                                                             |
|------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Skill not loaded             | Confirm the diff contains `.py` files. The agent selects skills by matching file types in the changed files against skill descriptions.                           |
| No findings generated        | Verify the `Skills Loaded` footer in the review output lists `python-foundational`. If listed but no findings appear, the diff may already satisfy the checklist. |
| Severity seems miscalibrated | Compare against the Severity Rubric above. High requires runtime impact; medium is maintainability-only.                                                          |

## Contributing

Follow these conventions when extending this skill:

* Checklist items belong in SKILL.md. Each bullet is a single, actionable check an agent or reviewer can apply to a diff. Keep bullets concise: one sentence, no code.
* Reference files live in `references/` and provide examples or rationale for the covered checklist items. Each reference file covers a contiguous range of sections. Update the References table when adding a new file.
* Before adding a new checklist item, confirm it does not duplicate an existing bullet in any section. Place it in the section that matches its primary concern. If it spans concerns, prefer the more specific section.
* Name new reference files after the topic they cover (e.g., `async-patterns.md`). Include a frontmatter `description` that states which sections the file supports. Add a row to the References table in SKILL.md.
* Checklist items and examples must be portable across codebases. Use generic module names and describe anti-patterns by their behavior, not by specific directory or file names.

---

*🤖 Crafted with precision by ✨Copilot following brilliant human instruction, then carefully refined by our team of discerning human reviewers.*

Related Skills

pr-reference

909
from microsoft/hve-core

Generates PR reference XML containing commit history and unified diffs between branches with extension and path filtering. Includes utilities to list changed files by type and read diff chunks. Use when creating pull request descriptions, preparing code reviews, analyzing branch changes, discovering work items from diffs, or generating structured diff summaries. - Brought to you by microsoft/hve-core

security-reviewer-formats

909
from microsoft/hve-core

Format specifications and data contracts for the security reviewer orchestrator and its subagents - Brought to you by microsoft/hve-core.

secure-by-design

909
from microsoft/hve-core

Secure by Design principles knowledge base for assessing adherence to security-first design, development, and deployment practices across the software lifecycle - Brought to you by microsoft/hve-core.

owasp-top-10

909
from microsoft/hve-core

OWASP Top 10 for Web Applications (2025) vulnerability knowledge base for identifying, assessing, and remediating security risks in web application environments - Brought to you by microsoft/hve-core.

owasp-mcp

909
from microsoft/hve-core

OWASP MCP Top 10 vulnerability knowledge base for identifying, assessing, and remediating security risks in Model Context Protocol environments - Brought to you by microsoft/hve-core.

owasp-llm

909
from microsoft/hve-core

OWASP Top 10 for LLM Applications (2025) vulnerability knowledge base for identifying, assessing, and remediating security risks in large language model systems - Brought to you by microsoft/hve-core.

owasp-infrastructure

909
from microsoft/hve-core

OWASP Infrastructure Top 10 vulnerability knowledge base for identifying, assessing, and remediating security risks in internal IT infrastructure environments - Brought to you by microsoft/hve-core.

owasp-cicd

909
from microsoft/hve-core

OWASP CI/CD Top 10 vulnerability knowledge base for identifying, assessing, and remediating security risks in continuous integration and continuous delivery environments - Brought to you by microsoft/hve-core.

owasp-agentic

909
from microsoft/hve-core

OWASP Agentic Security Top 10 vulnerability knowledge base for identifying, assessing, and remediating security risks in AI agent systems - Brought to you by microsoft/hve-core.

jira

909
from microsoft/hve-core

Jira issue workflows for search, issue updates, transitions, comments, and field discovery via the Jira REST API. Use when you need to search with JQL, inspect an issue, create or update work items, move an issue between statuses, post comments, or discover required fields for issue creation. - Brought to you by microsoft/hve-core

hve-core-installer

909
from microsoft/hve-core

Decision-driven installer for HVE-Core with 6 clone-based installation methods, extension quick-install, environment detection, and agent customization workflows - Brought to you by microsoft/hve-core

gitlab

909
from microsoft/hve-core

Manage GitLab merge requests and pipelines with a Python CLI - Brought to you by microsoft/hve-core