菜单
Review Django code for best practices, security, performance, and modern patterns. Automatically activated when reviewing Django files.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Configure the current project with Django 6.x expert tools (rules, skills, agents, hooks) from GitHub. Use when setting up a Django project.
Debug Django issues - ORM queries, migrations, template errors, async problems. Use when debugging Django applications.
Check and validate Django migrations for safety and correctness before deployment
Create a new REST API endpoint following modern DRF best practices
Create a new Django app following modern best practices and cookiecutter-django conventions
Create a new Django model following modern best practices
| name | django-review |
| description | Review Django code for best practices, security, performance, and modern patterns. Automatically activated when reviewing Django files. |
| allowed-tools | Read, Grep, Glob |
Use this comprehensive checklist when reviewing Django code. Check every applicable section.
mark_safe() — should use format_html() instead|safe filter on user-provided data in templatesformat_html() for HTML output.raw() and cursor.execute() use parameterized queries (%s placeholders).extra() calls without parameterization{% csrf_token %}@csrf_exempt without strong justification.env files in .gitignoreselect_related() used for ForeignKey/OneToOne accessed in loops/serializersprefetch_related() used for reverse FK/M2M accessed in loops/serializers# BAD: N+1 in template
{% for order in orders %}
{{ order.user.email }} {# triggers a query per order #}
{% endfor %}
# GOOD: prefetched in view
orders = Order.objects.select_related("user").all()
filter(), order_by(), get() have indexes.only() or .defer() for large models when only a few fields are needed.values() or .values_list() when full model instances aren't needed.exists() instead of len(qs) > 0 or bool(qs).count() instead of len(qs).iterator() for large querysets that don't need cachingbulk_create() / bulk_update() for batch operationsTimeStampedModel (or has created/modified timestamps)__str__ method definedMeta class with ordering, indexes, constraintsnull=True on CharField/TextFieldTextChoices/IntegerChoices for enum fieldsdb_default used for database-level defaultsrelated_name on all ForeignKey/M2M fieldson_delete deliberately chosen (not blindly CASCADE)services.pyselectors.py (not inline in views)@login_not_required only on genuinely public viewsfields = "__all__"){% partialdef %} used for reusable fragments (Django 6.0+){% querystring %} used for URL params (Django 5.1+)pytest + factory_boy (not JSON fixtures)typing module__future__ → stdlib → third-party → first-party → localexcept)get_object_or_404() for missing objectsWhen reporting findings, categorize as: