Django

Avoid common Django mistakes — QuerySet evaluation, N+1 queries, migration conflicts, and ORM traps.

Security Scan

This is a documentation-only Django best-practices skill whose requirements and files match its stated purpose and do not request unexpected access or installs.

Purpose & Capability

The name/description (Django ORM, N+1, migrations, security) matches the provided markdown files; the only declared binary requirement is python3, which is reasonable for a Django-focused skill and no unrelated credentials or tools are requested.

Instruction Scope

SKILL.md and the included docs contain static guidance and do not instruct the agent to read system secrets, access external endpoints, or run arbitrary commands. There is no scope creep in the runtime instructions.

Install Mechanism

No install spec and no code files — this is instruction-only, so nothing is downloaded or written to disk during install.

Credentials

The skill requests no environment variables, credentials, or config paths; requested access is minimal and proportional to being a documentation skill.

Persistence & Privilege

always is false and the skill is user-invocable; it does not request persistent system presence or modify other skills or system-wide settings.

Assessment

This skill is a set of static Django best-practice notes and appears internally consistent. Because it is instruction-only (no install, no secrets requested), it carries low risk by itself. Before installing, consider: (1) verify the content matches your expected Django version and coding standards, (2) be cautious if you later combine this skill with other skills that can execute code or access files — those could change the risk profile, and (3) review the security.md recommendations in your own codebase (e.g., ensure SECRET_KEY and ALLOWED_HOSTS are handled properly).

Quick Reference

Topic	File
QuerySet lazy eval, N+1, transactions	orm.md
Request handling, middleware, context	views.md
Validation, CSRF, file uploads	forms.md
Migrations, signals, managers	models.md
XSS, CSRF, SQL injection, auth	security.md
Async views, ORM in async, channels	async.md

Critical Rules

• QuerySets are lazy — iterating twice hits DB twice, use list() to cache
• select_related for FK/O2O, prefetch_related for M2M — or N+1 queries
• update() skips save() — no signals fire, no auto_now update
• F() for atomic updates — F('count') + 1 avoids race conditions
• get() raises DoesNotExist or MultipleObjectsReturned — use filter().first() for safe
• DEBUG=False requires ALLOWED_HOSTS — 400 Bad Request without it
• Forms need {% csrf_token %} — or 403 Forbidden on POST
• auto_now can't be overridden — use default=timezone.now if need manual set
• exclude(field=None) excludes NULL — use filter(field__isnull=True) for NULL
• Circular imports in models — use string reference: ForeignKey('app.Model')
• transaction.atomic() doesn't catch exceptions — errors still propagate
• sync_to_async for ORM in async views — ORM is sync-only