Django
BackendCommonly used with
Skills using Django (105)
app-builder
App scaffolding: Next.js, Vite, Nuxt, Astro, FastAPI, Django, Laravel, RN, Flutter. Triggers: scaffold, bootstrap, new project, starter, dashboard, mobile app.
api-test-suite-builder
Use when the user asks to generate API tests, create integration test suites, test REST endpoints, or build contract tests.
db-migrator
数据库迁移助手 - Schema 对比、迁移脚本生成
error-translator
编程错误消息翻译专家 — 将英文错误消息翻译成中文，解释原因并提供修复方案
log-analyzer
日志分析助手 — 智能解析日志文件，识别异常模式，定位问题根因
hunt-host-header
Hunt Host Header Injection — password reset poisoning → ATO, web cache poisoning via unkeyed Host/X-Forwarded-Host, routing-based SSRF (Host picks upstream → cloud metadata/internal services), path-override SSRF/ACL-bypass (X-Original-URL/X-Rewrite-URL), OAuth redirect_uri/issuer poisoning, and absolute-URL link poisoning in emails. High to Critical when it reaches ATO or mass cache poisoning. Built on public Host-header research (PortSwigger 'Practical web cache poisoning' + James Kettle, and the classic password-reset-poisoning class). Use on any forgot-password flow, CDN/reverse-proxy-fronted app, OAuth/OIDC endpoint, or absolute-URL-in-email feature.
pm-tech
Use when: 需要与技术团队对接技术方案、评估技术可行性、制定技术架构、评估第三方服务 Do NOT use when: 技术方案已由技术团队确定、仅需功能描述无需技术评估
app-ai-guardrails
Scaffold a new production application with the full agentic-AI guardrail canon baked in from commit #1: a uniform 7-gate interface (lint, typecheck, test, coverage, build, e2e, audit) on each stack's native runner, strict types, maximal static analysis, coverage thresholds with teeth plus seed tests, pre-commit hooks, hardened CI with optional SonarCloud, supply-chain pinning, and an agent-ready AGENTS.md — every gate verified green before the first commit. Native adapters: Next.js, NestJS, Django, Go, Rust, Spring Boot; a discovery method maps the canon to other stacks. USE FOR: creating or scaffolding a new app, service, or API from scratch; bootstrapping a greenfield repo that AI agents will build in. DO NOT USE FOR: retrofitting an existing codebase or scaffolding a new package into an existing monorepo (both assume repo-root ownership), LLM-safety or content-moderation guardrails, or adding a single tool to an existing project.
database-documentation
Generate grounded-and-verified, engine-agnostic database documentation that reaches 100% parity with the real schema. Introspects the LIVE database as ground truth and cross-validates it against ORM models, migrations, generated types, seeds, and application queries, then proves completeness by diffing the docs back against the database. Produces ER diagrams (mermaid), per-table data dictionaries, and a machine-readable schema.json. Works with PostgreSQL, MySQL, SQL Server, and SQLite across any ORM (Prisma, TypeORM, Drizzle, Sequelize, Knex, Django, Rails) or raw SQL. Use when asked to document a database, produce an ERD or data dictionary, write db/schema docs, audit schema drift, or refresh existing DB docs.
security-review
Exploitability-first standalone security review of code changes, diffs, PRs, or services. Use when asked for a security review, security audit, vulnerability assessment, or pre-merge security check (安全审查/安全评审/漏洞排查) — covers auth, input, secrets, API, data, concurrency, container, third-party, and dependency risk across Go, Node.js/TypeScript, Java, and Python, with mandatory evidence, false-positive suppression, scope-based depth (Lite/Standard/Deep), and CWE/OWASP-mapped machine-readable output. NOT for general-purpose Go code review — use go-review-lead for that (it dispatches go-security-review as its security dimension); this skill is the deeper security-only process with mandatory gates and audit-grade output.
lazy-agent-loader
Load agent definitions on-demand to reduce context usage. Only loads full agent when needed.
python-dev
Opinionated Python development setup with uv + ty + ruff + pytest + just. Use when creating new Python projects, setting up pyproject.toml, configuring linting, type checking, testing, or build tooling. Triggers on "python project", "uv init", "pyproject.toml", "ruff config", "ty check", "pytest setup", "justfile", "python linting", "python formatting", "type checking python".
django
Use when building Django applications. Covers ORM query performance, model design, migrations, Django REST Framework, security defaults, and testing.
bm25
Ranked content search over any text corpus using BM25 (via xhluca/bm25s). Corpus-agnostic: works on cloned repos, project knowledge stores, uploaded files/archives, and any local directory. Stateless — builds an in-memory index each invocation, no cache, no persistence. Use when you need ranked multi-word content search beyond grep, or when picking the "most relevant files for these terms" across a corpus. Triggers on "rank these documents", "search this corpus", "find content about X", "which files are most about Y", or multi-word concept queries against a known body of text.
python-expert
Python gotchas and decision criteria. Covers async pitfalls, FastAPI/Django patterns, and type hint traps.
holix-studio-frontend-backend
Wire frontend API base to the real Holix Studio backend public origin when both apps run in Studio. Use when building or fixing SPA/API monorepos, Vite/Next/React + FastAPI/Express, or any FE that calls a BE on another Studio preview port. Invoke via /holix-studio-frontend-backend.
neo-python
Use this skill when writing, reviewing, debugging, or architecting Python 3.10+ code, including type hints, structural pattern matching, dataclasses, async/task groups, packaging-aware project structure, testability, and maintainability.
harness-canary-authoring
Picking and asserting harden-harness canaries
poly-and-release-workflow
Commit step lint/test/harness order
api-endpoint
Use when creating an API endpoint or HTTP route handler — detects the project stack and routes to the matching carve-out (laravel-api-endpoint, nextjs-patterns, symfony-workflow).
security-audit
Application security audit covering OWASP Top 10, injection, XSS, SSRF, auth/authz, multi-tenant isolation, secrets, headers, dependencies, business logic, and infrastructure. Uses Sentry 3-tier confidence model. Supports Next.js, NestJS, Express, FastAPI, Django, Flask. Dual scoring: static posture + runtime exploitability. Flags: zuvo:security-audit [path] | full | --live-url <url> | --static | --quick | --persist-backlog
office-call-skill
Build and evolve a single high-fidelity counselor system for real student-counselor communication rehearsal, distillation, correction, and reality-sync practice.
design-prd
Generate Product Requirements Documents through structured conversation for any project. Auto-detects tech stack, existing features, and data model from the codebase. Uses Firecrawl to research competitor products and UX patterns, Context7 to check framework capabilities for feasibility, and Supabase MCP to verify data model feasibility. Produces actionable PRDs with technical feasibility sections informed by real codebase analysis. Use when starting a new feature, documenting requirements, creating specs before implementation, or needing clarity on scope and success criteria.
data-breach-blast-radius
Proactive blast radius analysis before a breach: sensitive data inventory, flow tracing, regulatory fine estimation (GDPR/CCPA/HIPAA), hardening roadmap. Triggers: /data-breach-blast-radius, breach impact.
python-project-setup
Sets up Python projects with modern tooling including pyproject.toml, linting with ruff, formatting, type checking with mypy or pyright, testing with pytest, and pre-commit hooks. Triggers on: "setup Python project", "create Python package", "python project structure", "pyproject.toml".
code-documenter
Use when adding docstrings, creating API documentation, or building documentation sites. Invoke for OpenAPI/Swagger specs, JSDoc, doc portals, tutorials, user guides.
django-expert
Use when building Django web applications or REST APIs with Django REST Framework. Invoke for Django models, ORM optimization, DRF serializers, viewsets, authentication with JWT.
developer-plugins-integration
Detects installed developer plugins (python-developer, frontend-developer, php-developer) and project stack, then provides a list of relevant skills to load for code review and fix workflows. Supports Python (FastAPI, SQLAlchemy, Pydantic, Django, Celery, asyncio, uv), Frontend (React, Tailwind, Zustand, TanStack, pnpm), and PHP (Symfony, Doctrine, DDD).
django-knowledge-patch
Django
vibe-security
Security intelligence for code analysis. Detects SQL injection, XSS, CSRF, authentication issues, crypto failures, and more. Actions: scan, analyze, fix, audit, check, review, secure, validate, sanitize, protect. Languages: JavaScript, TypeScript, Python, PHP, Java, Go, Ruby. Frameworks: Express, Django, Flask, Laravel, Spring, Rails. Vulnerabilities: SQL injection, XSS, CSRF, authentication bypass, authorization issues, command injection, path traversal, insecure deserialization, weak crypto, sensitive data exposure. Topics: input validation, output encoding, parameterized queries, password hashing, session management, CORS, CSP, security headers, rate limiting, dependency scanning.
using-chameleon
Active when .chameleon/ profile directory exists. Explains hook-injected pattern context and violation feedback for TypeScript/JavaScript, Ruby, and Python as first-class languages — framework-agnostic by default (it learns your repo's own conventions), with deeper awareness where conventions are strong: Rails for Ruby, Django/DRF/Flask/FastAPI for Python, and Next.js/NestJS for TypeScript/JavaScript.
python-backend-expert
This skill should be used when the user is writing, reviewing, debugging, or architecting Python backend services (FastAPI + SQLAlchemy 2.0 async + Pydantic v2) or long-running runtime processes (workers, ETL, daemons, CLI tools). Assumes Python 3.13+/3.14; detects installed libraries from pyproject.toml/uv.lock and adapts. Covers async correctness, dependency injection with Annotated[T, Depends], N+1 and MissingGreenlet, lifecycle and graceful shutdown, signals/subprocess/atomic writes, project structure, validation, testing, and AI-generated anti-patterns. Trigger phrases include "critique my FastAPI backend", "why am I getting MissingGreenlet", "is this blocking the event loop", "fix N+1 query", "structure my FastAPI project", "review my Pydantic models", "write a Python worker", "subprocess deadlock", and "process keeps growing in memory". Not for Django or Flask apps, notebooks, or data-science scripts — those stacks have different idioms this skill would misapply.
vibe-ship
Generates a complete, production-ready deployment setup for any app in one pass -- Dockerfile, docker-compose.yml, .dockerignore, CI/CD (GitHub Actions), scalability config (health checks, resource limits, K8s on request), and security hardening (non-root user, secrets, dependency scanning). Auto-detects the stack from repo files (package.json, requirements.txt, go.mod, pom.xml, Gemfile, etc.) and writes real working files, not just advice. Also audits an EXISTING Dockerfile/compose/CI setup with a static scoring script and reports concrete findings. Use whenever the user asks to "dockerize", "containerize", "make this deployable", "production-ready", "vibe ship this", "add CI/CD", "set up deployment", "ship this app", requests a Dockerfile/docker-compose/GitHub Actions workflow, or wants a deployment setup reviewed -- even for just one piece (e.g. "add a Dockerfile"), since the full set is interdependent.
tg-alerts
Use when adding Telegram error notifications to any project. Guides through bot creation with @BotFather, chat/channel/forum-topic ID discovery, alert service implementation with deduplication and graceful failure, and framework-specific integration for Python (async/sync) and Node.js.
find-docs
Retrieves up-to-date documentation, API references, and code examples for any developer technology. Use this skill whenever the user asks about a specific library, framework, SDK, CLI tool, or cloud service — even for well-known ones like React, Next.js, Prisma, Express, Tailwind, Django, or Spring Boot. Your training data may not reflect recent API changes or version updates. Always use for: API syntax questions, configuration options, version migration issues, "how do I" questions mentioning a library name, debugging that involves library-specific behavior, setup instructions, and CLI tool usage. Use even when you think you know the answer — do not rely on training data for API details, signatures, or configuration options as they are frequently outdated. Always verify against current docs. Prefer this over web search for library documentation and API details.
security-sweep
Scan codebase for security vulnerabilities, hardcoded secrets, injection flaws, misconfigurations, and attack surfaces. Use when user wants a security audit, vulnerability scan, or to find security issues.
database-migrations
Database migration best practices for schema changes, data migrations, rollbacks, and zero-downtime deployments across PostgreSQL, MySQL, and common ORMs (Prisma, Drizzle, Kysely, Django, TypeORM, golang-migrate).
stacks
Stack-specific skills organized by technology category (backend, frontend, infrastructure, mobile)
api-doc-gen
从 Flask、FastAPI、Express 或 Gin 等 Web 框架的源代码中自动扫描路由定义，生成符合 OpenAPI 3.0 / Swagger 规范的标准化 API 文档文件。当用户需要生成 API 文档、提到 OpenAPI、Swagger、接口文档、路由扫描或从代码自动提取接口信息时触发。
python-architecture-checklist
Grades an existing Python codebase. Detects Python version, framework (FastAPI/Django/Flask), and package layout, then checks clean-architecture boundaries, type-safety discipline, complexity, dependency direction, and config/secrets hygiene with file:line evidence. Use to review or grade a Python codebase. Not for Socratic critique (architecture-review), security audits (python-security-review), or new test-first code (tdd).
clean-architecture
Clean Architecture reference, reduced to this owner's positions and test-based enforcement. Use when scaffolding, reviewing layers, or designing a layered system.
project-structure
Use when deciding where code should live, organising files, or auditing project structure. Checks colocation, grouping, and directory anti-patterns.
database-security
Prevent SQL injection, ORM misuse, credential leaks; enforce least-privilege DB users and safe migrations — Applies to: when generating SQL or raw query strings; when generating ORM model code or queries; when generating database migration files; when wiring connection strings or pooling
chameleon-init
Use when the user explicitly invokes /chameleon-init to bootstrap a chameleon profile for the current repository (TypeScript/JavaScript, Ruby, or Python — framework-agnostic, with deeper awareness for Rails and Django/DRF/Flask/FastAPI)
finding-docs
Retrieves up-to-date documentation, API references, and code examples for any developer technology. Use whenever the user asks about a specific library, framework, SDK, CLI tool, or cloud service — including well-known ones like React, Next.js, Prisma, Django, or Spring Boot. Use for API syntax, configuration, version migration, setup, and library-specific debugging. Use even when you think you know the answer — training data and web search are frequently outdated for API details.
pdlc-adopt
旧项目接入 PDLC
django-skills
Django framework patterns, best practices, and implementation guides
api-error-check
Statically checks a web API's error-handling surface for conformance against the project's own declared error contract — uniform error-body shape, populated required fields, a dynamically-generated error/correlation id, correct HTTP status-code semantics, and no internal-detail leakage (stack traces, raw driver messages, rendered queries, secrets). Detects the web framework (FastAPI / Flask / Django REST / Express / NestJS / Spring and comparable) and the error contract from project signals, falling back to RFC 9457 defaults only when none is declared. Invoke after adding or changing endpoints, before a release, or as a pre-PR error-handling gate; also on requests like "check the API error handling", "audit error responses", or equivalent German-language requests. Read-only: reports and recommends, never edits handler code. Don't use for the whole-codebase security audit (code-security-reviewer) or general code review (review skill).
ralph
Autonomous agent loop for completing features. Use when asked to 'use ralph', 'ralph this', or to autonomously implement a feature end-to-end. Creates prd.json with user stories, then executes them one by one until complete.
deploy-planner
Deployment and DevOps agent that generates Dockerfiles, CI/CD configs, and step-by-step deployment guides for free hosting platforms. Triggers on: deploy, launch, hosting, Docker, CI/CD, production, go live, ship it.
dependency-upgrade-planner
Plan and de-risk a major dependency, framework, or runtime upgrade — map the full version path, read every intermediate migration guide, and pin the breaking changes to your actual call sites instead of bumping the number and hoping. Use when a key dependency is several majors behind, when a security advisory forces an upgrade, or before a framework migration.
linkrunner-webhooks
Set up a Linkrunner webhook receiver in a backend app to get real-time install and signup attribution events - detect the backend framework (Express, Fastify, Next.js API routes, NestJS, Flask, FastAPI, Django, etc.), add a route that verifies the linkrunner-key header, and handle the payload idempotently. Use when someone asks to set up Linkrunner webhooks, receive install/signup webhooks, or handle a Linkrunner webhook in their backend.
api-test-generate
Auto-generate comprehensive API tests for REST and GraphQL endpoints with request/response validation
sota-python
State-of-the-art Python engineering (2026 baseline) for both writing new Python and auditing existing Python code. Covers uv-based tooling and project setup, strict typing, idioms and pitfalls, asyncio structured concurrency, security (injection, deserialization, supply chain), performance, and FastAPI/Django/pytest practice. Use whenever the task involves Python source, pyproject.toml, requirements files, or Python tooling — building features, scaffolding projects, reviewing PRs, or hunting bugs/vulnerabilities. Trigger keywords: Python, pip, uv, pyproject, asyncio, Django, FastAPI, pytest, type hints, mypy, ruff, pydantic, SQLAlchemy, venv.
deploy
Deploys your app to DigitalOcean or AWS — generates Nginx config, SSL, systemd service, and step-by-step server setup for Ubuntu/CentOS
python
Python project wizard — FastAPI, Django, Flask, Celery, Jupyter — with proper pyenv/venv setup, DB, Docker, and deploy options
n-plus-one-hunter
Find and fix N+1 queries and related ORM query anti-patterns — the loop that quietly fires one database query per row. Reviews application code for N+1s, nested N+1s, count/exists-in-a-loop, cartesian eager-load blowups, over-fetching, and missing foreign-key indexes, then rewrites them with the correct eager-load strategy and shows the query-count before/after. Use whenever writing or reviewing code that loads a collection and touches an association, a serializer or API response, a GraphQL resolver, a view template, or a background job — in ActiveRecord/Rails, the Django ORM, Prisma, SQLAlchemy, Sequelize, TypeORM, Ecto, or raw query code — and especially before merging an endpoint that renders a list.
brainstorming
Refine ideas into actionable designs via Socratic questioning (simple mode) or parallel multi-agent analysis (--deep). Includes scoring matrix, tier detection, and security review. Use when: exploring a feature idea, making architectural decisions, comparing design approaches, or starting a complex project. Triggers on: brainstorm, help me design, explore options, architect, how should we, design a, what approach, trade-offs, compare approaches
database-migrations
Use when writing or reviewing schema migrations. Covers zero-downtime Postgres patterns (concurrent indexes, instant defaults, expand-contract) and tool-specific CLI workflows and gotchas for Prisma, Drizzle, Kysely, Django, TypeORM, and golang-migrate.
uv-deps
Maintain Python packages through security audits or dependency updates using an isolated git worktree and uv. Use for security audits, CVE fixes, vulnerability checks, dependency updates, package upgrades, outdated packages, bump versions, fix Python vulnerabilities, check for Python CVEs, audit Python packages, update pyproject.toml dependencies, modernize Python deps, or when user types /uv-deps with or without specific package names or glob patterns.
do-oop-audit
Audit Python classes for OOP and data-modeling anti-patterns. Use when reviewing class design, boundaries, or hierarchy, or 'check my classes', 'lint class structure', 'scan for design issues'.
api-contract-init
Generate API_CONTRACT.md by scanning existing routes and controllers
backend-master-agent
Backend implementation playbook — API endpoints, database models/migrations, auth, query optimization, and the framework-specific traps that break servers in production. Use when implementing or reviewing server-side code: FastAPI / Django / Flask / Express / NestJS / Go / Axum handlers, SQLAlchemy / Prisma / Mongoose / Tortoise models, JWT / OAuth / session auth, bcrypt / argon2 password hashing, rate limiting, N+1 query fixes, async/event-loop bugs, or when a handoff spec asks for "the backend" of a feature.
cm-backend-engineer
后端 API 工程师 Skill，执行服务端 API 层开发（路由、业务逻辑、鉴权中间件、缓存、队列），自动适配语言和框架
django-patterns
Django patterns, anti-patterns, ORM gotchas, view design, migrations, settings, and review checklist for Django backend work. Use whenever the project contains `manage.py`, `settings.py`, `apps.py`, OR `pyproject.toml`/`requirements.txt`/`Pipfile` with `django` (or `Django`) listed as a dependency, OR the user asks about Django, Python web backend, ORM queries, models, views, forms, templates, migrations, admin, signals, middleware, or any work touching `.py` files in a Django app structure, even if Django is not mentioned by name.
drf-patterns
Django REST Framework patterns, serializers, viewsets, permissions, throttling, filtering, pagination, and review checklist. Use whenever the project contains `djangorestframework` in dependencies, `rest_framework` in INSTALLED_APPS, files following DRF naming patterns (`serializers.py`, `viewsets.py`, `permissions.py`), OR the user asks about DRF, Django REST, serializers, viewsets, ModelViewSet, permission_classes, throttle_classes, even if DRF is not mentioned by name.
fastapi-patterns
FastAPI patterns, Pydantic schemas, dependency injection, async correctness, response models, error handling, OpenAPI, and auth. Use whenever the project contains `fastapi` in dependencies, files importing from `fastapi`, `@app.get`/`@router.get` decorators, Pydantic BaseModel subclasses used as request/response types, OR the user asks about FastAPI, Pydantic v2, Depends(), HTTPException, OAuth2PasswordBearer, APIKeyHeader, response_model, even if FastAPI is not mentioned by name.
security-patterns
Security checklist covering XSS, injection, authentication, authorization, sessions, CSRF, CSP, secrets, dependency CVEs, input validation, and severity calls. Use whenever the project includes auth code, session handling, environment variable reads, user input handling, route handlers, server actions, middleware, or external API calls, OR the user asks about security, hardening, vulnerabilities, auth, authentication, authorization, sessions, cookies, XSS, CSRF, SQL injection, secrets, environment variables, CSP, headers, or reviews changes that touch user input, auth, or external data, even if "security" is not mentioned by name.
security-audit-light
Perform a PR-scoped security audit on a small to medium code change (1-20 files, additive endpoint, schema change, refactor). Produces a structured findings table with confidence scores, no false positives, and a clean verdict. Trigger only when the user explicitly asks for a "security audit", "security review", "vulnerability check", "is this safe to ship", or "OWASP check" of recent changes. NOT for greenfield threat modeling, full-codebase reviews, or infrastructure audits — those need heavier tooling. NOT for proactive scanning while writing code.
docker-deploy
Use when creating Dockerfiles, docker-compose configs, or containerizing applications. Covers multi-stage builds, image optimization, compose patterns for dev and production, health checks, signal handling, and security hardening.
boilerplate
Generate framework-specific boilerplate code
starting-a-project
Use when someone is starting a new project and unsure what stack or framework to build it with — "what should I use to build X?", "how do I start a new project?" — or asks how to deploy / put a project online. Covers the common beginner goals: a content website, an interactive app, a database-backed web app, an API, a script or automation, a phone app, a data dashboard.
perf-bar
Use when assessing performance or algorithmic soundness — Big-O on hot paths, N+1 queries, Supabase egress, and benchmarking hard challenges; feeds the SPIKE sub-phase and per-task review.
stacks
Use when building or maintaining a project in one of my non-default stacks — Flipper Zero FAP in C now, Django / Flask / FastAPI coming — for its architecture, build, test, formatting and release conventions. Routes to references/<stack>/. The web stack (TS / Supabase / PWA) is the pack's implicit default and has no entry here.
paper-fetch
Use when the user wants to download a paper PDF from a DOI (or title, resolved to a DOI first). Tries Unpaywall, arXiv, bioRxiv/medRxiv, PubMed Central, Semantic Scholar, and Sci-Hub mirrors as a last-resort fallback.
behave
When the user wants to design, implement, debug, or operate BDD tests on Python using behave. Use when the user mentions "behave," "behave.ini," "@given/@when/@then," "context.x," "environment.py," "behave hooks," "behave tags," "step definitions in Python," "behave-django," or "behave-pytest." For language-agnostic Gherkin patterns see cucumber-gherkin. For .NET BDD see specflow-reqnroll. For BDD failure modes see bdd-anti-patterns. For non-BDD Python testing see pytest.
locust
When the user wants to design, implement, debug, or operate Locust load tests in Python. Use when the user mentions "Locust," "HttpUser," "@task," "TaskSet," "locustfile.py," "master/worker," "Locust web UI," "FastHttpUser," "constant_pacing," "wait_time," or "locust -f -u -r --headless." For k6 see k6. For JMeter see jmeter. For Gatling see gatling. For Node-based perf see artillery.
pytest
When the user wants to design, implement, debug, or optimize pytest tests in Python. Use when the user mentions "pytest," "pytest fixtures," "conftest.py," "pytest.ini," "pyproject.toml pytest section," "@pytest.fixture," "@pytest.mark.parametrize," "pytest-xdist," "pytest-asyncio," "pytest-cov," "monkeypatch," "tmp_path," "capsys," or "pytest plugins." For pytest-based API testing see pytest-api. For JS/TS unit testing see jest-vitest. For Java see junit-testng. For .NET see xunit-nunit.
pytest-api
When the user wants to design, implement, debug, or scale Python API tests using pytest + requests/httpx. Use when the user mentions "pytest API tests," "requests for API testing," "httpx," "pytest fixtures for API," "responses (mock library)," "respx," "vcr.py," "schemathesis," or "FastAPI TestClient." For Java API testing see rest-assured. For Node API testing see supertest. For Postman collections see postman-newman. For contract testing see pact-contract-testing.
catalog-conventions
Add or modify a PostgreSQL system-catalog entry — covers adding a pg_proc.dat builtin function, pg_operator.dat operator, pg_type.dat type, pg_cast.dat cast, pg_opclass.dat opclass, adding a new column on pg_class / pg_aggregate / pg_attribute / etc., BKI bootstrap entries, OID assignment policy (genbki.pl, unused_oids), catversion (CATALOG_VERSION_NO) bumping, and regenerating postgres.bki. Use whenever a PG patch edits anything under src/include/catalog/ (.h or .dat), adds a SQL-visible builtin (function/operator/type/cast/opclass), assigns or recycles an OID, or bumps the catversion. Skip for user-level information_schema queries on a running server, Django / Alembic / Rails / Flyway / Liquibase migrations, Oracle DBA_* / MySQL information_schema / Snowflake INFORMATION_SCHEMA catalog questions, schema design and normalization advice, ER-diagram tooling, and adding constraints to user-application tables.
find-docs
Retrieves up-to-date documentation, API references, and code examples for any developer technology. Use this skill whenever the user asks about a specific library, framework, SDK, CLI tool, or cloud service -- even for well-known ones like React, Next.js, Prisma, Express, Tailwind, Django, or Spring Boot. Your training data may not reflect recent API changes or version updates. Always use for: API syntax questions, configuration options, version migration issues, "how do I" questions mentioning a library name, debugging that involves library-specific behavior, setup instructions, and CLI tool usage. Use even when you think you know the answer -- do not rely on training data for API details, signatures, or configuration options as they are frequently outdated. Always verify against current docs. Prefer this over web search for library documentation and API details.
analyze
Deep cross-layer consistency audit for any codebase. Traces every feature from UI to database, finds broken wiring, missing handlers, model mismatches, and security gaps. Auto-fixes critical and warning issues. Use this after building features, before releases, or whenever something feels off. Works with any tech stack.
api-surface
Maps the entire API surface of a codebase -- route definitions, middleware chains, auth requirements, request/response types, deprecated endpoints, orphaned endpoints, and cross-endpoint inconsistencies. USE THIS SKILL WHEN: - You need a complete inventory of all API endpoints in a project - Someone asks "what endpoints do we have?" or "what does our API look like?" - You are onboarding to a new backend codebase and need to understand its API - You need to find orphaned, undocumented, or deprecated endpoints - Someone asks about API inconsistencies (different response shapes, auth gaps) - You are preparing for an API review, documentation sprint, or versioning migration - You need to understand endpoint dependencies before refactoring - A project has no OpenAPI spec and you need to generate one from code - You suspect there are endpoints without authentication or rate limiting TRIGGER PHRASES: "API surface", "list all endpoints", "API inventory", "endpoint map", "orphaned endpoints", "API inconsistencies", "u
python-conventions
Use when a ticket adds or changes Python code and it must follow the repo's Python conventions — PEP 8, full type hints, dataclasses, pythonic idioms, explicit error handling, and pytest with coverage. Invoke for "add this in Python", "fix the type/lint errors", "add the FastAPI/Django endpoint", or as the language pack for any Python change.
codebase-auditor
Scan a repository against curated coding standards and produce a structured audit report, issue set, refactor plan, and sprint-based remediation roadmap. Use when the user invokes /vibe.audit or asks to review the codebase against established rules. Operates in full autopilot mode from repository scan to sprint plan output.
hive-spec-miner
Reverse-engineering specialist that extracts specifications from existing codebases. Use when working with legacy or undocumented systems, inherited projects, or old codebases with no documentation. Invoke to map code dependencies, generate API documentation from source, identify undocumented business logic, figure out what code does, or create architecture documentation from implementation. Trigger phrases: reverse engineer, old codebase, no docs, no documentation, figure out how this works, inherited project, legacy analysis, code archaeology, undocumented features.
celery-patterns
Celery patterns for distributed task queues — task definitions, retry strategies, scheduling, chains/groups, monitoring, and production configuration with Redis/RabbitMQ.
database-migrations
Database migration best practices for schema changes, data migrations, rollbacks, and zero-downtime deployments. Covers Alembic, Django, and raw SQL.
deployment-patterns
Deployment workflows, CI/CD pipeline patterns, Docker containerization, health checks, rollback strategies for Python applications.
django-patterns
Django architecture patterns, REST API design with DRF, ORM best practices, caching, signals, middleware, and production-grade Django apps.
django-security
Django security best practices, authentication, authorization, CSRF protection, SQL injection prevention, XSS prevention, and secure deployment configurations.
django-tdd
Django testing strategies with pytest-django, TDD methodology, factory_boy, mocking, coverage, and testing Django REST Framework APIs.
docker-patterns
Docker and Docker Compose patterns for Python development, container security, networking, and multi-service orchestration.
redis-patterns
Redis patterns for Python — caching, sessions, pub/sub, rate limiting, distributed locks, and integration with Django/FastAPI.
github-copilot-starter
Set up a GitHub Copilot customisation starter pack for a new project based on its technology stack, including instructions, skills, agents, and optional setup workflow files.
find-docs
Retrieves up-to-date documentation, API references, and code examples for any developer technology. Use this skill whenever the user asks about a specific library, framework, SDK, CLI tool, or cloud service -- even for well-known ones like React, Next.js, Prisma, Express, Tailwind, Django, or Spring Boot. Your training data may not reflect recent API changes or version updates. Always use for: API syntax questions, configuration options, version migration issues, "how do I" questions mentioning a library name, debugging that involves library-specific behavior, setup instructions, and CLI tool usage. Use even when you think you know the answer -- do not rely on training data for API details, signatures, or configuration options as they are frequently outdated. Always verify against current docs. Prefer this over web search for library documentation and API details.
hotwire
Deep reference for the Hotwire stack from the official handbooks — Turbo (Drive, Frames, Streams, morphing page refreshes), Stimulus (controllers, actions, targets, values, outlets), and Hotwire Native (wrap a web app into iOS and Android apps with bridge components and path configuration). Use this skill whenever the user works with Turbo or Stimulus in any backend (Rails, Laravel, Django, Phoenix, plain HTML), mentions turbo-rails, stimulus-rails, @hotwired packages, turbo_frame_tag, turbo_stream, broadcasts, data-controller/data-action/data-*-target attributes, morphing, "SPA-like without a SPA", partial page updates, live updates over WebSockets — or wants a mobile app from their web app: Hotwire Native, Turbo Native, Strada, bridge components, path configuration, WKWebView/ webview wrapper apps, or "turn my Rails app into an iOS/Android app". Pair with the rails-8 skill for Rails integration specifics.
flask-quality
Flaskプロジェクトの品質チェック。pytest-flask/mypy(strict)/Black/isortを実行。「Flaskの品質チェック」「Flask テスト」「Flaskのテスト実行」「Flask lint」「Flask型チェック」「Flaskフォーマット」で起動。Do NOT use for Django等の他フレームワーク、汎用Python品質チェック（→ python-quality）。
data
Set up database / persistent-state discipline for a project with a DB. Authors a data-auditor agent (5 categories of integrity check), a migration-create skill, query-discipline rule (CLI > MCP DB tool for reads), and edit-time regen hook — all derived from the project's actual schema, migration framework, and access-control model. Optionally an RLS-security-reviewer if Postgres + row-level security is in use. Invoke /dotclaude:data in any project with persistent state.
zeal-docs
Consult offline documentation from locally installed Zeal (Linux) / Dash docsets. Use this WHENEVER a coding, debugging, or config task involves a technology that has a docset installed — to confirm exact signatures, flags, return values, defaults, or behavior instead of relying on memory, AND for conceptual "how do I / how does X work" questions, since docsets also contain tutorials and how-to guides. Installed docsets include Ansible, Bash, Bootstrap 5, C, Django, Docker, ElasticSearch, Emmet, Flask, Go, HTML, Jinja, Nginx, NodeJS, PostgreSQL, Python 3, Python Telegram Bot, Redis, Rust, SQLAlchemy, SQLite, Scrapy, and Wagtail. Trigger on questions like "what are the args to X", "does this function return Y", "which flag does Z", "how do I do X in Python/Go/...", or before writing non-trivial API calls in these languages/frameworks. Works fully offline; no network needed.
Showing top 100 of 105 skills using Django by quality score.
See all 105 skills via search →Integration detected automatically from skill content. Some results may be false positives.