Django
BackendCommonly used with
Skills using Django (268)
hunt-host-header
Hunt Host Header Injection — password reset poisoning → ATO, web cache poisoning via unkeyed Host/X-Forwarded-Host, routing-based SSRF (Host picks upstream → cloud metadata/internal services), path-override SSRF/ACL-bypass (X-Original-URL/X-Rewrite-URL), OAuth redirect_uri/issuer poisoning, and absolute-URL link poisoning in emails. High to Critical when it reaches ATO or mass cache poisoning. Built on public Host-header research (PortSwigger 'Practical web cache poisoning' + James Kettle, and the classic password-reset-poisoning class). Use on any forgot-password flow, CDN/reverse-proxy-fronted app, OAuth/OIDC endpoint, or absolute-URL-in-email feature.
development
开发语言能力索引。Python、Go、Rust、TypeScript、Java、C++、Shell。当用户提到编程、开发、代码、语言时路由到此。
sharedtech-stack-detection
检测项目技术栈的通用方法，通过分析配置文件识别语言、框架、工具链
app-builder
App scaffolding: Next.js, Vite, Nuxt, Astro, FastAPI, Django, Laravel, RN, Flutter. Triggers: scaffold, bootstrap, new project, starter, dashboard, mobile app.
api-docs-generator
Audits and enhances FastAPI and REST API documentation: missing descriptions, response codes, examples, docstrings, Pydantic models, OpenAPI spec. Triggers on: "generate API docs", "document this API", "OpenAPI for", "FastAPI docs", "document endpoints", "swagger docs".
migration-risk-analyzer
Analyzes database migration scripts for lock contention, downtime, rollback strategy, and deployment risk. Triggers on: "analyze this migration", "migration risk", "is this migration safe", "schema change risk", "DDL risk", "rollback strategy", "migration review".
deploy-to-temps
Deploy applications to the Temps platform with automatic framework detection, Dockerfile generation, and container orchestration. Supports Next.js, Vite, React, Node.js, Python, Go, Rust, Java, and C# applications. Use when the user wants to: (1) Deploy their app to Temps, (2) Set up CI/CD with Temps, (3) Configure deployment settings, (4) Create a Dockerfile for Temps, (5) Deploy a containerized application, (6) Set up automatic deployments from Git. Triggers: "deploy to temps", "temps deployment", "push to temps", "containerize for temps", "temps ci/cd".
django-expert
Use when building Django web applications or REST APIs with Django REST Framework. Invoke when working with settings.py, models.py, manage.py, or any Django project file. Creates Django models with proper indexes, optimizes ORM queries using select_related/prefetch_related, builds DRF serializers and viewsets, and configures JWT authentication. Trigger terms: Django, DRF, Django REST Framework, Django ORM, Django model, serializer, viewset, Python web.
django-storages-s3
Use when configuring Django to store static and media files on AWS S3 with django-storages. Invoke when working with the STORAGES setting, S3 buckets, presigned URLs, CloudFront, or boto3-backed file storage in settings.py. Configures the Django 4.2+ STORAGES dict, public/private custom backends, presigned GET/POST URLs, IAM policies, and S3 mocking for tests. Trigger terms: django-storages, S3, boto3, S3Boto3Storage, STORAGES, presigned URL, CloudFront, media files, collectstatic, AWS_STORAGE_BUCKET_NAME.
api-test-suite-builder
Use when the user asks to generate API tests, create integration test suites, test REST endpoints, or build contract tests.
great_cto
Use when the CTO describes a feature, task, or project goal. Orchestrates the full SDLC pipeline automatically based on project type.
db-migrator
数据库迁移助手 - Schema 对比、迁移脚本生成
error-translator
编程错误消息翻译专家 — 将英文错误消息翻译成中文，解释原因并提供修复方案
log-analyzer
日志分析助手 — 智能解析日志文件，识别异常模式，定位问题根因
configuration-generator
Generate configuration files for applications, services, and infrastructure. Use when: (1) Setting up new projects (package.json, requirements.txt, tsconfig.json), (2) Creating Docker or Kubernetes configurations, (3) Configuring CI/CD pipelines (GitHub Actions, GitLab CI, CircleCI), (4) Setting up web servers (Nginx, Apache), (5) Defining infrastructure as code (Terraform, CloudFormation), (6) Generating linter/formatter configs (ESLint, Prettier, Black). Provides templates and custom-generated configs for diverse tech stacks.
security-review
Exploitability-first standalone security review of code changes, diffs, PRs, or services. Use when asked for a security review, security audit, vulnerability assessment, or pre-merge security check (安全审查/安全评审/漏洞排查) — covers auth, input, secrets, API, data, concurrency, container, third-party, and dependency risk across Go, Node.js/TypeScript, Java, and Python, with mandatory evidence, false-positive suppression, scope-based depth (Lite/Standard/Deep), and CWE/OWASP-mapped machine-readable output. NOT for general-purpose Go code review — use go-review-lead for that (it dispatches go-security-review as its security dimension); this skill is the deeper security-only process with mandatory gates and audit-grade output.
pm-tech
Use when: 需要与技术团队对接技术方案、评估技术可行性、制定技术架构、评估第三方服务 Do NOT use when: 技术方案已由技术团队确定、仅需功能描述无需技术评估
lazy-agent-loader
Load agent definitions on-demand to reduce context usage. Only loads full agent when needed.
python-dev
Opinionated Python development setup with uv, ty, ruff, pytest, lefthook, and just. Use when creating a new Python project, writing or fixing pyproject.toml, or configuring linting, formatting, type checking, testing, git hooks, or CI.
django-seedkit
Bootstrap a new Django project, or add components — auth (allauth, magic-link, axes, 2FA), payments (Stripe, dj-stripe), REST (django-modern-rest, django-bolt), Celery / django-tasks, async views & WebSockets (ASGI, uvicorn worker, django-channels, channels-redis), Tailwind+DaisyUI, favicon, SEO meta tags + sitemap, HTML email templates, S3 storage, structlog, healthchecks, Docker, CI, deploy (VPS / Fly / GitHub-SSH), dbbackup, Sentry/Bugsink — to an existing Django codebase. Use whenever the user wants to scaffold Django, integrate a Django package, set up async / WebSockets, set up production deploys, wire CI/CD, or extend an existing Django project.
database-migrations
Database migration best practices for schema changes, data migrations, rollbacks, and zero-downtime deployments across PostgreSQL, MySQL, and common ORMs (Prisma, Drizzle, Kysely, Django, TypeORM, golang-migrate).
bm25
Ranked content search over a text corpus you point it at, using BM25 (via xhluca/bm25s). Corpus-agnostic: cloned repos, project knowledge stores, uploaded files and archives, any local directory. In-memory BM25 index per invocation, with a session-local disk cache for repeat runs against the same corpus. Use for "rank these documents", "search this corpus", "which files are most about X", "find content about Y", or any multi-word concept query against a known body of text where grep would return everything or nothing. Needs a corpus on disk. Not for searching stored memories or prior-session decisions (remembering), not for a named symbol or a file's structure (tree-sitting), and not for a literal string you could grep.
database-migrations
Database migration best practices for schema changes, data migrations, rollbacks, and zero-downtime deployments across PostgreSQL, MySQL, and common ORMs (Prisma, Drizzle, Django, TypeORM, golang-migrate). Use when planning or implementing database schema changes.
api-documentation-generator
Generates OpenAPI-compatible documentation for REST API endpoints from code or route definitions.
observatory
Context for the jcodemunch-observatory weekly scorecard — what it tracks, the Monday 06:00 UTC cron, why scores must be pulled live rather than transcribed, the NestJS grade story, and the workflow's version dispatch input. Load before quoting, interpreting, or editing observatory scores or config.
python-expert
Python gotchas and decision criteria. Covers async pitfalls, FastAPI/Django patterns, and type hint traps.
django
Use when building Django applications. Covers ORM query performance, model design, migrations, Django REST Framework, security defaults, and testing.
harness-canary-authoring
Picking and asserting harden-harness canaries
poly-and-release-workflow
Commit step lint/test/harness order
api-endpoint
Use when creating an API endpoint or HTTP route handler — detects the project stack and routes to the matching carve-out (laravel-api-endpoint, nextjs-patterns, symfony-workflow).
scaffold-project
Scaffold a new project with standard structure, configs, and CLAUDE.md
design-prd
Generate Product Requirements Documents through structured conversation for any project. Auto-detects tech stack, existing features, and data model from the codebase. Uses Firecrawl to research competitor products and UX patterns, Context7 to check framework capabilities for feasibility, and Supabase MCP to verify data model feasibility. Produces actionable PRDs with technical feasibility sections informed by real codebase analysis. Use when starting a new feature, documenting requirements, creating specs before implementation, or needing clarity on scope and success criteria.
python-project-setup
Sets up Python projects with modern tooling including pyproject.toml, linting with ruff, formatting, type checking with mypy or pyright, testing with pytest, and pre-commit hooks. Triggers on: "setup Python project", "create Python package", "python project structure", "pyproject.toml".
neo-python
Use this skill when writing, reviewing, debugging, or architecting Python 3.10+ code, including type hints, structural pattern matching, dataclasses, async/task groups, packaging-aware project structure, testability, and maintainability.
app-ai-guardrails
Scaffold a new production application with the full agentic-AI guardrail canon baked in from commit #1: a uniform 7-gate interface (lint, typecheck, test, coverage, build, e2e, audit) on each stack's native runner, strict types, maximal static analysis, coverage thresholds with teeth plus seed tests, pre-commit hooks, hardened CI with optional SonarCloud, supply-chain pinning, and an agent-ready AGENTS.md — every gate verified green before the first commit. Native adapters: Next.js, NestJS, Django, Go, Rust, Spring Boot; a discovery method maps the canon to other stacks. USE FOR: creating or scaffolding a new app, service, or API from scratch; bootstrapping a greenfield repo that AI agents will build in. DO NOT USE FOR: retrofitting an existing codebase or scaffolding a new package into an existing monorepo (both assume repo-root ownership), LLM-safety or content-moderation guardrails, or adding a single tool to an existing project.
database-documentation
Generate grounded-and-verified, engine-agnostic database documentation that reaches 100% parity with the real schema. Introspects the LIVE database as ground truth and cross-validates it against ORM models, migrations, generated types, seeds, and application queries, then proves completeness by diffing the docs back against the database. Produces ER diagrams (mermaid), per-table data dictionaries, and a machine-readable schema.json. Works with PostgreSQL, MySQL, SQL Server, and SQLite across any ORM (Prisma, TypeORM, Drizzle, Sequelize, Knex, Django, Rails) or raw SQL. Use when asked to document a database, produce an ERD or data dictionary, write db/schema docs, audit schema drift, or refresh existing DB docs.
mir-backend-python
Make It Right (Python runtime tier). CPython runtime reliability footguns that are shared across EVERY Python backend framework (FastAPI, Django, Flask, Celery) — distinct from the generic backend gates and from any one framework's mechanics. Covers: the GIL and the free-threaded build (PEP 703/779, officially supported since 3.14 but not the default), async-vs-sync 'coloring', blocking the event loop, choosing asyncio vs threads vs multiprocessing vs subinterpreters vs a worker queue, fork-safety of connection pools and the 3.14 forkserver default change, lazy annotations (PEP 649/749), serverless cold starts, dropped-task exceptions, and runtime-level security (unsafe deserialization, archive extraction, shell arguments, SSRF, packaging supply chain). TRIGGER when the backend runtime is Python — sits between mir-backend (generic) and the framework module (e.g. mir-backend-python-fastapi). SKIP for Node/JVM/Go/Rust/.NET/Ruby/PHP/BEAM runtimes (each has its own mir-backend-<runtime> tier), and for framework-l
mir-backend-python-django
Make It Right (Django module). Django 6.1 / 5.2 LTS + Django REST Framework specific reliability augmentation. Use alongside the mir-backend skill when the target stack is Django — it carries the mechanical footguns that the framework-agnostic skill deliberately omits: ORM N+1 with select_related/prefetch_related and the new QuerySet.fetch_mode() (FETCH_PEERS / FETCH_RAISE), queryset laziness and result caching, migration safety on populated tables (lock_timeout, AddIndexConcurrently, db_default), transaction.atomic() and on_commit() boundaries, mass assignment through ModelForm and DRF serializers, async views and the async ORM (transactions do NOT work in async; CONN_MAX_AGE must be off), the built-in django.tasks background framework added in 6.0, signal side-effect traps, and Django's own 2026 security advisories. TRIGGER only when the Python backend stack is Django — building, reviewing, or debugging a Django view, model, serializer, migration, task, or admin. Always loads TOGETHER WITH mir-backend (the
secure-code-auditor
Backend security auditor for Django and DRF on an OWASP Top 10 (2025), API Security Top 10 (2023), and ASVS 5.0 foundation. Use when backend code is written or reviewed and touches authentication, sessions, cookies, JWT, OAuth2/OIDC, API keys, password hashing, permissions, access control, IDOR, SSRF, path traversal, open redirect, impersonation, SQL/command/template injection, LDAP, row-level security, encrypted columns, NoSQL, Redis, file uploads, S3, serializers, rate limiting, CSRF/CORS, OpenAPI schema, GraphQL, Django Ninja, gRPC, AI agents, MCP tools, secrets, payments, webhooks, Celery, Django tasks, race conditions, ReDoS, caching, deserialization, async/ASGI, WebSockets, audit logging, erasure, retention, personal data, migrations, JWKS, mutual TLS, SECRET_KEY, SBOM, X-Forwarded-For, SPF/DKIM/DMARC, or deployment config, even if "security" is never used. Review-time returns prioritized findings with fixes; write-time applies secure defaults. Django/DRF-first; general layer suits any stack.
django-ticket-triage
Analyze a Django Trac ticket and produce a triage recommendation report — duplicate search, related PRs, forum threads, and the affected source code. Use when the user gives a Django ticket number, or asks whether a ticket is valid, a duplicate, or ready for a triage stage.
django-knowledge-patch
Django
migration-safety
Static scan of migration files for online-safety violations — blocking `CREATE INDEX` without `CONCURRENTLY`, `NOT NULL` added with no safe backfill, destructive drops of columns the running code still reads, and table-rewriting DDL. Run on any diff that adds or edits a migration, and before a deploy that ships a schema change. Not the timed rehearsal against prod-sized data — that is `migration-rehearsal` in the database pack.
vibe-security
Security intelligence for code analysis. Detects SQL injection, XSS, CSRF, authentication issues, crypto failures, and more. Actions: scan, analyze, fix, audit, check, review, secure, validate, sanitize, protect. Languages: JavaScript, TypeScript, Python, PHP, Java, Go, Ruby. Frameworks: Express, Django, Flask, Laravel, Spring, Rails. Vulnerabilities: SQL injection, XSS, CSRF, authentication bypass, authorization issues, command injection, path traversal, insecure deserialization, weak crypto, sensitive data exposure. Topics: input validation, output encoding, parameterized queries, password hashing, session management, CORS, CSP, security headers, rate limiting, dependency scanning.
django
Django batteries-included Python framework. Covers models, views, templates, ORM, and admin. Use when building full-featured Python web applications. USE WHEN: user mentions "django", "django orm", "django admin", "django templates", asks about "python cms", "django rest framework", "drf", "django models", "django migrations", "django channels", "django forms" DO NOT USE FOR: FastAPI projects - use `fastapi` instead, Flask projects - use `flask` instead, async-first Python APIs, microservices without admin panel
fastapi
FastAPI modern Python web framework. Covers routing, Pydantic models, dependency injection, and async support. Use when building Python APIs. USE WHEN: user mentions "fastapi", "pydantic", "async python api", "python rest api", asks about "dependency injection python", "python openapi", "python swagger", "async endpoints", "python api validation", "fastapi middleware" DO NOT USE FOR: Django apps - use `django` instead, Flask apps - use `flask` instead, synchronous Python APIs without type hints, GraphQL-only APIs
deploy-check
MUST use before any git push to main/master/production, or when user mentions 'deploy', 'going live', 'push to prod', 'ready to ship', 'merge to main', 'release'. Also trigger before any npm publish for CLI tools, or on 'audit', 'check vulnerabilities', 'are our deps safe?', 'npm audit', 'yarn audit'. Performs: test suite validation, dev-artifact scan (`console.log`, `TODO`/`FIXME`, hardcoded secrets like `password:` / `token:` / API keys), dependency audit (npm audit, pip-audit, bundle audit, cargo audit, govulncheck, etc.), build verification, ORM/schema safety check, auth-middleware coverage on new endpoints. Verdict: GO / NO-GO with per-check checklist.
data-migration
Evolve stored schemas, file formats, and archive generations with rehearsed migration and recovery. Use when existing persisted data must survive a change.
django
Bootstrap and maintain production-minded Django applications with a small typed Python stack. Use for Django projects, apps, models, views, admin, settings, migrations, or tests.
pdlc-adopt
旧项目接入 PDLC
make-docs
Create, edit, and validate technical documentation using the Diataxis framework. Use when writing tutorials, how-to guides, reference docs, or explanations. Use when reviewing or auditing existing documentation for structural correctness. Use when deciding what type of document to write. Also use when the user mentions Diataxis, documentation quality, documentation types, or asks to write 'deep dive' articles, onboarding guides, API docs, or architectural explanations. Do NOT use for code comments, commit messages, changelogs, or README generation.
developer-plugins-integration
Detects installed developer plugins (python-developer, frontend-developer, php-developer) and project stack, then provides a list of relevant skills to load for code review and fix workflows. Supports Python (FastAPI, SQLAlchemy, Pydantic, Django, Celery, asyncio, uv), Frontend (React, Tailwind, Zustand, TanStack, pnpm), and PHP (Symfony, Doctrine, DDD).
django
Django + FastAPI development. Project structure, DRF serializers/viewsets, Pydantic, async Django with ASGI, admin, ORM optimization, deployment.
docker
Docker containerization — Dockerfile, multi-stage builds, Docker Compose, image size optimization, security scanning, networking, volumes.
django-expert
Use when building Django web applications or REST APIs with Django REST Framework. Invoke when working with settings.py, models.py, manage.py, or any Django project file. Creates Django models with proper indexes, optimizes ORM queries using select_related/prefetch_related, builds DRF serializers and viewsets, and configures JWT authentication. Trigger terms: Django, DRF, Django REST Framework, Django ORM, Django model, serializer, viewset, Python web.
django-storages-s3
Use when configuring Django to store static and media files on AWS S3 with django-storages. Invoke when working with the STORAGES setting, S3 buckets, presigned URLs, CloudFront, or boto3-backed file storage in settings.py. Configures the Django 4.2+ STORAGES dict, public/private custom backends, presigned GET/POST URLs, IAM policies, and S3 mocking for tests. Trigger terms: django-storages, S3, boto3, S3Boto3Storage, STORAGES, presigned URL, CloudFront, media files, collectstatic, AWS_STORAGE_BUCKET_NAME.
django-security
Django security best practices, authentication, authorization, CSRF protection, SQL injection prevention, XSS prevention, and secure deployment configurations.
data-breach-blast-radius
Proactive blast radius analysis before a breach: sensitive data inventory, flow tracing, regulatory fine estimation (GDPR/CCPA/HIPAA), hardening roadmap. Triggers: /data-breach-blast-radius, breach impact.
code-documenter
Use when adding docstrings, creating API documentation, or building documentation sites. Invoke for OpenAPI/Swagger specs, JSDoc, doc portals, tutorials, user guides.
django-expert
Use when building Django web applications or REST APIs with Django REST Framework. Invoke for Django models, ORM optimization, DRF serializers, viewsets, authentication with JWT.
stack-detect
Detect language, framework, database, spatial libraries and tile stack from repo files before DB, dashboard or deploy work. Python, .NET, Node/Next.js, Expo.
security-sweep
Scan codebase for security vulnerabilities, hardcoded secrets, injection flaws, misconfigurations, and attack surfaces. Use when user wants a security audit, vulnerability scan, or to find security issues.
documentation
ALWAYS invoke for any task involving docstrings, JSDoc/TSDoc, or REST API documentation — even when the request seems handleable without it. Enforces Microsoft contract-first conventions and a bare-minimum rule that Claude won't apply by default: never restate the signature, drop @param/@returns that only echo names and types, always document @throws, and document data shapes as WHAT not WHY. Covers Python docstring styles (Google/NumPy/Sphinx), TSDoc tags and @inheritDoc, and API doc patterns for NestJS/Express/FastAPI/Django. Trigger on: adding or auditing docstrings, redundant or missing tags, deleting comment rot, or producing a documentation-health report. Do not skip for documentation tasks — consistent conventions are the whole point.
bermuda
Coordinate with other agents and run multi-step work through the Bermuda harness — threads (what changed on this machine), claims (exclusive resources like the browser), @mentions, the forum (durable, searchable posts other agents find later), memory (standing facts as Obsidian notes), and flows (declared steps instead of one long prompt). Use before taking a shared resource, when another agent needs to know something, when looking for what an earlier agent already worked out, and whenever a task has a step that must not be skipped.
security-audit
Application security audit covering OWASP Top 10, injection, XSS, SSRF, auth/authz, multi-tenant isolation, secrets, headers, dependencies, business logic, infrastructure, and AI/LLM + MCP tool-invocation security (S15, incl. tool poisoning and confused-deputy). Uses Sentry 3-tier confidence model. Supports Next.js, NestJS, Express, FastAPI, Django, Flask. Dual scoring: static posture + runtime exploitability. Flags: zuvo:security-audit [path] | full | --live-url <url> | --static | --quick | --persist-backlog
office-call-skill
Build and evolve a single high-fidelity counselor system for real student-counselor communication rehearsal, distillation, correction, and reality-sync practice.
sota-python
State-of-the-art Python engineering (2026 baseline) for both writing new Python and auditing existing Python code. Covers uv-based tooling and project setup, strict typing, idioms and pitfalls, asyncio structured concurrency, security (injection, deserialization, supply chain), performance, and FastAPI/Django/pytest practice. Use whenever the task involves Python source, pyproject.toml, requirements files, or Python tooling — building features, scaffolding projects, reviewing PRs, or hunting bugs/vulnerabilities. Trigger keywords: Python, pip, uv, pyproject, asyncio, Django, FastAPI, pytest, type hints, mypy, ruff, pydantic, SQLAlchemy, venv.
python-architecture-checklist
Grades an existing Python codebase. Detects Python version, framework (FastAPI/Django/Flask), and package layout, then checks clean-architecture boundaries, type-safety discipline, complexity, dependency direction, and config/secrets hygiene with file:line evidence. Use to review or grade a Python codebase. Not for Socratic critique (architecture-review), security audits (python-security-review), or new test-first code (tdd).
stacks
Stack-specific skills organized by technology category (backend, frontend, infrastructure, mobile)
aidex-coverage
Use when writing, placing, or running tests in any project — which layer a behaviour belongs in ("unit or E2E for X", "component test or browser test"), which tests to run for a change instead of the whole suite, when to extract a fixture, setting up an isolated disposable E2E environment, or the per-project testing profile and the stack pack it names for the concrete test shapes (Django, Vue, Playwright, Payload, Svelte). Fires on "write a test for", "add a regression test", "which tests should I run", "run only the affected tests", "set up E2E for this project", "generate test-e2e.sh", "how do we test this stack". Not for: running a coverage audit, the module map / coverage matrix, tracking a finding, or suite-speed measurement — all of that is aidex-audit's test-coverage playbook.
project-structure-guide
依各語言的最佳實踐組織專案目錄結構的指南。 Use when: 建立專案、重整結構、新增模組、設定建置流程、決定檔案該放哪裡。 Not for: 專門為 AI 導覽而設計的結構——請用 /ai-friendly-architecture；原地重整既有程式碼——請用 /refactor。 Keywords: project, structure, directory, layout, gitignore, scaffold, file placement, utils, helpers, shared, 專案結構, 目錄配置, 檔案擺放.
find-docs
Retrieves up-to-date documentation, API references, and code examples for any developer technology. Use this skill whenever the user asks about a specific library, framework, SDK, CLI tool, or cloud service — even for well-known ones like React, Next.js, Prisma, Express, Tailwind, Django, or Spring Boot. Your training data may not reflect recent API changes or version updates. Always use for: API syntax questions, configuration options, version migration issues, "how do I" questions mentioning a library name, debugging that involves library-specific behavior, setup instructions, and CLI tool usage. Use even when you think you know the answer — do not rely on training data for API details, signatures, or configuration options as they are frequently outdated. Always verify against current docs. Prefer this over web search for library documentation and API details.
architecture-ddd
도메인 주도 설계(DDD) 지식 — 전략 패턴(바운디드 컨텍스트·유비쿼터스 언어·컨텍스트 맵·증류·이벤트 스토밍), 전술 패턴(값 객체·엔티티·애그리거트·리포지토리·도메인 서비스·응용 서비스·도메인 이벤트·Specification), 유연한 설계, 아키텍처(계층+DIP·핵사고날·CQRS), 구현 패턴(패키지 구조·Data Mapper·Repository+UoW·Event Sourcing·Saga·패턴 선택). 도메인 언어·비즈니스 정책·애그리거트 경계·컨텍스트 경계·도메인 이벤트 채택을 결정할 때 먼저 로드한다. Django 구현 코드는 implementation-django, outbox 전달 보장과 트랜잭션 설계는 architecture-db, API 계약은 architecture-api로 위임.
discipline-houserules
dddjango 플러그인 고유 하우스룰 — ①표준 파일트리(BC 골격 140행·배치 결정 순서·이관/브라운필드 취급) ②타입 어노테이션(모든 이름의 첫 대입에 필수) ③코드 주석·docstring 언어 규율. 코드를 어느 파일/디렉터리에 둘지·어떻게 타입을 달지·주석을 어느 언어로 쓸지 정하거나 검수할 때 로드한다. 새 모듈·BC·테스트를 만들거나 프로젝트 레이아웃·코드 규약을 결정·점검하는 상황이면 반드시 사용. 트리와 규칙 «값»의 단일 출처는 references/final.md 다. 보편 클린코드는 dddjango:discipline-cleancode, Python 타입 지식은 implementation-python, 테스트 타입 조직은 dddjango:implementation-test(§4.2).
implementation-test
테스트 코드 작성법 종합 지식 — 테스트 전략·피라미드, migration 전용 테스트와 DB-backed 현행 동작 테스트의 기술적 구분, pytest 구조·픽스처·마커·플러그인, Mock·테스트더블, Property-Based Testing, 팩토리, 시간·HTTP 모킹, 통합 테스트, 커버리지, 테스트 품질·안티패턴, Mutation Testing, BDD, mounted Django client API 계약, Idempotency·동시성 테스트, 디버깅. 테스트 코드·픽스처·테스트더블·계약 검증 코드를 새로 작성하거나 리팩터링할 때 먼저 로드한다. 무엇을 테스트하고 기존 테스트를 유지·갱신·분리·삭제할지는 discipline-tdd, Django 구현은 implementation-django 계열로 위임.
archlens-postgres
Document a project's PostgreSQL schema and rigorously review its logical and physical design in one pass — wrong cardinality, unenforced natural keys, junction tables that allow duplicates, tenant-isolation gaps, enum-ish columns with no CHECK, soft-delete/UNIQUE collisions, polymorphic references, and the places where the next feature will hurt. Use this whenever the user asks to review, audit, document, or sanity-check a database schema, data model, ERD, migrations, or "our tables"; when they ask whether a data model will scale or what an extension would break; or when a PR touches schema.sql / migrations and they want a design opinion, not just a syntax check. Also use it when asked to generate database documentation — the docs and the review come from the same run.
db-architecture-review
Document a project's PostgreSQL schema and rigorously review its logical and physical design in one pass — wrong cardinality, unenforced natural keys, junction tables that allow duplicates, tenant-isolation gaps, enum-ish columns with no CHECK, soft-delete/UNIQUE collisions, polymorphic references, and the places where the next feature will hurt. Use this whenever the user asks to review, audit, document, or sanity-check a database schema, data model, ERD, migrations, or "our tables"; when they ask whether a data model will scale or what an extension would break; or when a PR touches schema.sql / migrations and they want a design opinion, not just a syntax check. Also use it when asked to generate database documentation — the docs and the review come from the same run.
dependency-upgrade-planner
Plan and de-risk a major dependency, framework, or runtime upgrade — map the full version path, read every intermediate migration guide, and pin the breaking changes to your actual call sites instead of bumping the number and hoping. Use when a key dependency is several majors behind, when a security advisory forces an upgrade, or before a framework migration.
database-migrations
Database migration best practices for schema changes, data migrations, rollbacks, and zero-downtime deployments across PostgreSQL, MySQL, and common ORMs (Prisma, Drizzle, Kysely, Django, TypeORM, golang-migrate).
python-backend-expert
This skill should be used when the user is writing, reviewing, debugging, or architecting Python backend services (FastAPI + SQLAlchemy 2.0 async + Pydantic v2) or long-running runtime processes (workers, ETL, daemons, CLI tools). Assumes Python 3.13+/3.14; detects installed libraries from pyproject.toml/uv.lock and adapts. Covers async correctness, dependency injection with Annotated[T, Depends], N+1 and MissingGreenlet, lifecycle and graceful shutdown, signals/subprocess/atomic writes, project structure, validation, testing, and AI-generated anti-patterns. Trigger phrases include "critique my FastAPI backend", "why am I getting MissingGreenlet", "is this blocking the event loop", "fix N+1 query", "structure my FastAPI project", "review my Pydantic models", "write a Python worker", "subprocess deadlock", and "process keeps growing in memory". Not for Django or Flask apps, notebooks, or data-science scripts — those stacks have different idioms this skill would misapply.
backend-fundamentals
Stack-agnostic backend patterns. Use when writing or modifying any server-side code (HTTP handler, DB query, background job, auth/middleware, webhook) regardless of language or framework. Covers services/selectors split, idempotency, error envelopes, migration discipline, N+1 avoidance, scale-aware design, auth guardrails, and logging hygiene.
clean-code
Universal coding principles applied on every code change — fail-closed error handling, self-documenting code, edge-case awareness, and test coverage for error paths. Stack-agnostic; covers Python, TypeScript/JavaScript, Go, and any other language. Triggers on every commit that touches code files.
python-django
Use when creating or modifying Python files in the src/backend/ directory — Django models, DRF views, serializers, services, selectors, Celery tasks, migrations, or tests. Triggers on any .py file change under src/backend/. Covers architecture patterns (services + selectors), exception hierarchy, error envelope, file upload validation, and testing standards specific to this Django/DRF codebase.
code-review-python
Security review of Python code — dangerous sinks and framework-specific pitfalls (Django/Flask/ FastAPI). Load when reviewing a Python codebase/PR, on .py source in scope, or "review this Python". Signals: requirements.txt/pyproject, Django/Flask/FastAPI, ORMs, pickle/yaml, subprocess.
django--uv
Provides expert knowledge for building Django 5+ projects with UV as the package manager, domain-driven app structure, ruff for linting, and pytest-django for testing.
django-orm
Django ORM patterns for multi-tenant POS projects: efficient queries, bulk operations, transactions, and multi-schema upload paths. Trigger: When writing queryset logic, model saves, or DB-touching service code.
django-testing
Testing patterns for multi-tenant Django POS projects using pytest-django, RequestFactory, and mocks. No factories, no complex conftest. Trigger: When writing or reviewing tests in any apps/ directory.
python-django-stack
Python and Django conventions for multi-tenant SaaS POS projects: views, services, naming, JSON APIs, PDFs, and cart patterns. Trigger: When writing any view, service, API endpoint, or model code in apps/.
security
Provides expert knowledge for implementing and reviewing application security following OWASP Top 10 (2021), with stack-specific patterns for Spring Boot, Django, Next.js, and Astro.
database-migrations
Database migration best practices for schema changes, data migrations, rollbacks, and zero-downtime deployments across PostgreSQL, MySQL, and common ORMs (Prisma, Drizzle, Kysely, Django, TypeORM, golang-migrate).
django-skills
Django framework patterns, best practices, and implementation guides
api-doc-gen
从 Flask、FastAPI、Express 或 Gin 等 Web 框架的源代码中自动扫描路由定义，生成符合 OpenAPI 3.0 / Swagger 规范的标准化 API 文档文件。当用户需要生成 API 文档、提到 OpenAPI、Swagger、接口文档、路由扫描或从代码自动提取接口信息时触发。
django-import-enforcer
Automatically validate and fix Django import patterns to use absolute modular imports with aliases. Use when writing imports, creating new Python files, modifying existing files, or seeing import statements in code.
migration-safety-checker
This skill should be used when the user asks to "create a migration", "run makemigrations", "modify a model field", "rename a column", or mentions "schema change", "alter table", "database migration". Validates migrations are production-safe.
model-entity-validator
This skill should be used when the user asks to "create a model", "add a Django model", "create database table", "add entity", "define schema", or when writing class definitions inheriting from models.Model. Validates BaseModel inheritance pattern.
performance-optimizer
This skill should be used when the user asks to "optimize queries", "fix slow queries", "improve performance", "detect N+1", "add indexes", or when writing Django ORM queries that access related objects. Detects and fixes performance issues.
security-first-validator
This skill should be used when the user asks to "create an API endpoint", "add a view", "write a viewset", "create a serializer", or when writing Django REST Framework code. Enforces security requirements (permissions, authentication, rate limiting).
tdd-planner
This skill should be used when the user asks to "plan a feature", "prepare for dev loop", "structure TDD approach", "break down this task", "create development plan", or when generating structured prompts for iterative development. Creates dev-loop-ready plans with TDD phases, file tables, code snippets, and framework-specific guidance.
test-coverage-advisor
This skill should be used when the user asks to "write tests", "generate tests", "check coverage", "add test cases", or when completing features and saying "done", "finished", "ready for review". Suggests tests for 90%+ coverage.
vibe-ship
Generates a complete, production-ready deployment setup for any app in one pass -- Dockerfile, docker-compose.yml, .dockerignore, CI/CD (GitHub Actions), scalability config (health checks, resource limits, K8s on request), and security hardening (non-root user, secrets, dependency scanning). Auto-detects the stack from repo files (package.json, requirements.txt, go.mod, pom.xml, Gemfile, etc.) and writes real working files, not just advice. Also audits an EXISTING Dockerfile/compose/CI setup with a static scoring script and reports concrete findings. Use whenever the user asks to "dockerize", "containerize", "make this deployable", "production-ready", "vibe ship this", "add CI/CD", "set up deployment", "ship this app", requests a Dockerfile/docker-compose/GitHub Actions workflow, or wants a deployment setup reviewed -- even for just one piece (e.g. "add a Dockerfile"), since the full set is interdependent.
analyze
Deep cross-layer consistency audit for any codebase. Traces every feature from UI to database, finds broken wiring, missing handlers, model mismatches, and security gaps. Auto-fixes critical and warning issues. Use this after building features, before releases, or whenever something feels off. Works with any tech stack.
Showing top 100 of 268 skills using Django by quality score.
See all 268 skills via search →Integration detected automatically from skill content. Some results may be false positives.