360 Secure SkillHub
360 安全技能中心

pip

核心功能:创建项目虚拟环境,执行Python包的安装、升级、卸载等操作,维护requirements.txt及生成固定版本依赖,排查pip常见故障(如环境冲突、构建失败等)。典型场景:Python项目依赖搭建、pip安装报错处理、生成可复现的依赖配置。遵循安全优先原则,优先使用虚拟环境避免全局安装,输出为标准化的命令指导及问题解决方案。

jvy
jvy
热度 57.17
最近更新 2026-05-11 17:31:45
分类:开发依赖:代码执行 / 读写文件应用场景:DevOps / 自动化脚本 / 工作流

安装技能

复制下面的话术发给你的 Agent,它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill: npx secure-skills-cli add pip
Metadata
name
pip
description
Use pip for Python package install, upgrade, freeze, and dependency file workflows with virtual environments first. Use when handling requirements.txt, pip install errors, pipx vs pip decisions, or reproducible Python dependency setup.
metadata
{"openclaw":{"emoji":"🐍","requires":{"bins":["python3"],"anyBins":["pip","pip3"]},"install":[{"id":"brew","kind":"brew","formula":"python","bins":["python3"],"label":"Install Python + pip (brew)"},{"id":"apt","kind":"apt","package":"python3-pip","bins":["pip3"],"label":"Install pip (apt)"}]}}

pip

Use this skill for Python dependency management with safe defaults and reproducible results.

Scope

  • Create and maintain project-local virtual environments
  • Install, upgrade, uninstall, and inspect Python packages
  • Manage requirements.txt and lock-like pinned outputs (pip freeze)
  • Troubleshoot common pip failures (externally-managed-environment, resolver conflicts, wheel/build failures)

Safety Defaults

  • Prefer isolated installs:
    • project: python3 -m venv .venv
    • app CLI: pipx (if available)
  • Avoid global installs unless user explicitly asks.
  • Prefer python3 -m pip ... instead of bare pip to avoid interpreter mismatch.
  • Never run unknown setup.py or arbitrary install scripts without explicit user approval.

Fast Path

# Initialize venv once per project
python3 -m venv .venv
. .venv/bin/activate
python3 -m pip install --upgrade pip

# Install deps
python3 -m pip install -r requirements.txt

# Pin exact versions
python3 -m pip freeze > requirements.txt

Common Operations

# Install one or more packages
python3 -m pip install requests pydantic

# Upgrade specific package(s)
python3 -m pip install --upgrade requests

# Uninstall package
python3 -m pip uninstall -y requests

# Show package details
python3 -m pip show requests

# List outdated packages
python3 -m pip list --outdated

Reproducible Dependency Flows

# Install from lock-like file
python3 -m pip install -r requirements.txt

# Generate pinned snapshot
python3 -m pip freeze > requirements.txt

# Export JSON metadata for automation
python3 -m pip list --format=json

Troubleshooting

  • externally-managed-environment:
    • Use a venv (python3 -m venv .venv) and retry inside it.
    • If user asked for app CLI install, prefer pipx install <tool>.
  • No matching distribution found:
    • Check Python version compatibility.
    • Check package name/version typo.
    • Try python3 -m pip index versions <pkg> when available.
  • Build/compile failure:
    • Upgrade build tooling: python3 -m pip install -U pip setuptools wheel
    • Install system headers/toolchain if needed, then retry.

Helper Script

Use the bundled helper for repeatable flows:

{baseDir}/scripts/pip-safe.sh detect
{baseDir}/scripts/pip-safe.sh ensure-venv .venv
{baseDir}/scripts/pip-safe.sh install --venv .venv -- requests pydantic
{baseDir}/scripts/pip-safe.sh requirements --venv .venv requirements.txt
{baseDir}/scripts/pip-safe.sh freeze --venv .venv > requirements.txt

Decision Rules

  • If task is project dependencies: use venv + pip.
  • If task is standalone CLI tool install for a user: suggest pipx first.
  • If system policy blocks global installs: stay in venv and explain why.