Menu
Review Django code for best practices, security, performance, and modern patterns. Automatically activated when reviewing Django files.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Configure the current project with Django 6.x expert tools (rules, skills, agents, hooks) from GitHub. Use when setting up a Django project.
Debug Django issues - ORM queries, migrations, template errors, async problems. Use when debugging Django applications.
Check and validate Django migrations for safety and correctness before deployment
Create a new REST API endpoint following modern DRF best practices
Create a new Django app following modern best practices and cookiecutter-django conventions
Create a new Django model following modern best practices
| name | django-review |
| description | Review Django code for best practices, security, performance, and modern patterns. Automatically activated when reviewing Django files. |
| allowed-tools | Read, Grep, Glob |
Use this comprehensive checklist when reviewing Django code. Check every applicable section.
mark_safe() — should use format_html() instead|safe filter on user-provided data in templatesformat_html() for HTML output.raw() and cursor.execute() use parameterized queries (%s placeholders).extra() calls without parameterization{% csrf_token %}@csrf_exempt without strong justification.env files in .gitignoreselect_related() used for ForeignKey/OneToOne accessed in loops/serializersprefetch_related() used for reverse FK/M2M accessed in loops/serializers# BAD: N+1 in template
{% for order in orders %}
{{ order.user.email }} {# triggers a query per order #}
{% endfor %}
# GOOD: prefetched in view
orders = Order.objects.select_related("user").all()
filter(), order_by(), get() have indexes.only() or .defer() for large models when only a few fields are needed.values() or .values_list() when full model instances aren't needed.exists() instead of len(qs) > 0 or bool(qs).count() instead of len(qs).iterator() for large querysets that don't need cachingbulk_create() / bulk_update() for batch operationsTimeStampedModel (or has created/modified timestamps)__str__ method definedMeta class with ordering, indexes, constraintsnull=True on CharField/TextFieldTextChoices/IntegerChoices for enum fieldsdb_default used for database-level defaultsrelated_name on all ForeignKey/M2M fieldson_delete deliberately chosen (not blindly CASCADE)services.pyselectors.py (not inline in views)@login_not_required only on genuinely public viewsfields = "__all__"){% partialdef %} used for reusable fragments (Django 6.0+){% querystring %} used for URL params (Django 5.1+)pytest + factory_boy (not JSON fixtures)typing module__future__ → stdlib → third-party → first-party → localexcept)get_object_or_404() for missing objectsWhen reporting findings, categorize as: