Python Mutable Default Args

A Python function uses a mutable object (list, dict, set) as a default argument, sharing state across calls in a way that produces silent bugs.

Security Scan

The skill is an instruction-only guide about Python mutable default-argument bugs; its claims, required resources, and instructions are coherent and proportionate.

Purpose & Capability

Name and description match the SKILL.md content. The skill only explains a common Python pitfall and remediation; it requests no binaries, credentials, or config that would be unrelated to that purpose.

Instruction Scope

Instructions are limited to explaining the bug, showing safe code patterns, suggesting heuristics for searching code (signatures like '=[]', '={}', '=set()'), and recommending linters (pylint/ruff). The skill does not instruct the agent to read system files, access environment variables, or transmit data externally.

Install Mechanism

No install spec or code files are present (instruction-only). Nothing will be written to disk or executed by an installer as part of installing this skill.

Credentials

The skill requests no environment variables, credentials, or config paths. No sensitive access is required to accomplish the stated purpose.

Persistence & Privilege

always is false and the skill is user-invocable; autonomous invocation is allowed (platform default) but the skill's instructions are benign and do not require elevated or persistent system privileges.

Assessment

This skill is a harmless, text-only explanation of a Python coding pitfall and how to fix it. It requires no install, no credentials, and does not instruct the agent to read or transmit files. You can safely enable or use it to get guidance on mutable default arguments. If you plan to act on its suggestions, consider enabling linters (pylint/ruff) and running a repository-wide search for patterns like '=[]', '={}', and '=set()' to find instances to fix. If you want stricter assurance, review the SKILL.md yourself — it contains all runtime instructions and performs no external actions.

Python evaluates default argument values once at function definition time, not on each call. If the default is a mutable object — a list, dict, or set — that object is shared across every call that uses the default. Mutating it inside the function modifies the default for all future calls. The bug is invisible until the second or later call and produces state-dependent failures that are hard to trace.

Symptoms

def add_item(item, items=[]):   # ← shared list
    items.append(item)
    return items

add_item("a")  # ["a"]
add_item("b")  # ["a", "b"]  ← unexpected; second caller sees first caller's data

• A function that accumulates data into a list or dict default grows unboundedly across calls.
• A function that should be stateless produces different results on the second call than the first.
• Unit tests pass in isolation but fail when run together due to shared state from a prior test.
• The bug disappears if the function is called with an explicit argument.

What to do

• Use None as the default and initialize the mutable inside the function body:

  def add_item(item, items=None):
      if items is None:
          items = []
      items.append(item)
      return items
  

• This is the canonical Python idiom. Every call that omits items gets a fresh list.

• Applies equally to dict, set, and any other mutable type. The rule is: never use a mutable as a default argument.

• When reviewing code, scan every function signature for =[], ={}, =set() as a heuristic for this pattern.

• Linters (pylint rule W0102, ruff rule B006) will flag this automatically — enable them if the codebase doesn't already.