[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6GXDTK0RYRC0S5AX5EQVRED":3,"skill-same:01M6GXDTK0RYRC0S5AX5EQVRED":72},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":49,"commitSha":50,"skillDirectory":51,"forksCount":52,"repositoryHtmlUrl":53,"repositoryHomepageUrl":53,"ownerHtmlUrl":54,"ownerBlogUrl":55,"ownerDescription":56,"updatedAt":57,"install":58,"resources":71},"01M6GXDTK0RYRC0S5AX5EQVRED","Django Review",null,"Deep review of Django applications — ORM query efficiency, middleware ordering, template security, form validation, and authentication patterns.","malayvuong\u002Fagent-orchestra","malayvuong","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F13240975?v=4","01M6GXCDVPB2VPZMDZK1KF98M0","Nguyen Minh Vuong","01M6GXCE176VDX3XV4Z4KNR33J",1,"MIT","https:\u002F\u002Fgithub.com\u002Fmalayvuong\u002Fagent-orchestra\u002Fblob\u002Fmain\u002F.agent-orchestra\u002Fskills\u002Fdjango-review\u002FSKILL.md",[],[5,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"django","review","orm","middleware","authentication patterns","form","logic","deep","efficiency","query","patterns","template","applications","REST","deep review","validation","authentication","performance","security","2026-11-10 10:12:30",false,"---\nname: Django Review\ndescription: Deep review of Django applications — ORM query efficiency, middleware ordering, template security, form validation, and authentication patterns.\nversion: 2026.3.1\nlicense: MIT\ntriggers:\n  lenses:\n    - logic\n    - security\n    - performance\n  keywords:\n    - django\n    - orm\n    - queryset\n    - middleware\n    - django rest framework\n---\n\nWhen reviewing Django code, apply the following framework-specific checks.\n\n## ORM N+1 Queries\n\nFor every view that iterates over a QuerySet and accesses related objects, verify `select_related()` (foreign keys, one-to-one) or `prefetch_related()` (many-to-many, reverse foreign keys) is used. Flag template loops that trigger lazy-loaded queries per iteration — each `.related_field` access without prefetching is a separate database round-trip.\n\nCheck for QuerySets evaluated multiple times — `queryset.count()` followed by iteration triggers two queries. Flag `list(queryset)` conversions that defeat lazy evaluation benefits. Verify `.only()` or `.defer()` is used when only a subset of fields is needed.\n\n## Migration Safety\n\nFlag migrations that add non-nullable columns without defaults on tables with existing data — this locks the table and fails. Verify `AddField` with `null=True` is used first, followed by a data migration, then `AlterField` to set `null=False`.\n\nCheck for `RunPython` migrations that load all rows into memory. Flag migrations that depend on model code that may change in future migrations — use `apps.get_model()` instead of importing models directly.\n\nVerify migrations are reversible — every `RunPython` should have a `reverse_code` parameter. Flag `ALTER TABLE` in raw SQL migrations without a corresponding reverse statement.\n\n## Template Security\n\nVerify `{% autoescape %}` is enabled (it is by default). Flag uses of `|safe` filter or `mark_safe()` on user-supplied data — these bypass XSS protection. Check that `{% csrf_token %}` is present in every POST form. Flag AJAX calls that skip the CSRF token header.\n\nCheck that template variables containing HTML are escaped at the point of output, not at the point of storage. Flag `{{ variable|safe }}` where `variable` originates from user input at any point in the data flow.\n\n## Authentication and Authorization\n\nVerify `@login_required` or `LoginRequiredMixin` is applied to every view that should be protected. Flag views that check `request.user.is_authenticated` but still execute logic for unauthenticated users before the check.\n\nCheck permission decorators: `@permission_required` should use the correct permission string. Flag views that check `request.user.is_superuser` for authorization — use the permission system instead. Verify object-level permissions are checked when the view modifies or deletes specific objects.\n\n## Form and Serializer Validation\n\nVerify `form.is_valid()` is always called before accessing `form.cleaned_data`. Flag direct access to `request.POST` or `request.GET` without form validation. Check that custom form `clean_*` methods raise `ValidationError` with user-friendly messages.\n\nFor Django REST Framework: verify serializers validate all input fields. Flag `serializer.save()` calls without checking `serializer.is_valid(raise_exception=True)`. Check that `ModelSerializer` uses `fields` or `exclude` explicitly — never `fields = '__all__'` on models with sensitive fields.\n\n## Settings Security\n\nFlag `DEBUG = True` in any settings file used for production. Verify `SECRET_KEY` is loaded from an environment variable, not hardcoded. Check that `ALLOWED_HOSTS` is set to specific domains — not `['*']`.\n\nVerify `SECURE_SSL_REDIRECT`, `SESSION_COOKIE_SECURE`, `CSRF_COOKIE_SECURE` are `True` for production. Flag missing `SECURE_HSTS_SECONDS` setting.\n\n## Middleware Ordering\n\nVerify `SecurityMiddleware` is first. Check that `SessionMiddleware` comes before `AuthenticationMiddleware`. Flag `CorsMiddleware` placed after middleware that reads the response — it must be near the top to set headers on all responses.\n\nFor each finding, report: the file, the Django-specific pattern violated, and the recommended fix.\n","When reviewing Django code, apply the following framework-specific checks.\n\n## ORM N+1 Queries\n\nFor every view that iterates over a QuerySet and accesses related objects, verify `select_related()` (foreign keys, one-to-one) or `prefetch_related()` (many-to-many, reverse foreign keys) is used. Flag template loops that trigger lazy-loaded queries per iteration — each `.related_field` access without prefetching is a separate database round-trip.\n\nCheck for QuerySets evaluated multiple times — `queryset.count()` followed by iteration triggers two queries. Flag `list(queryset)` conversions that defeat lazy evaluation benefits. Verify `.only()` or `.defer()` is used when only a subset of fields is needed.\n\n## Migration Safety\n\nFlag migrations that add non-nullable columns without defaults on tables with existing data — this locks the table and fails. Verify `AddField` with `null=True` is used first, followed by a data migration, then `AlterField` to set `null=False`.\n\nCheck for `RunPython` migrations that load all rows into memory. Flag migrations that depend on model code that may change in future migrations — use `apps.get_model()` instead of importing models directly.\n\nVerify migrations are reversible — every `RunPython` should have a `reverse_code` parameter. Flag `ALTER TABLE` in raw SQL migrations without a corresponding reverse statement.\n\n## Template Security\n\nVerify `{% autoescape %}` is enabled (it is by default). Flag uses of `|safe` filter or `mark_safe()` on user-supplied data — these bypass XSS protection. Check that `{% csrf_token %}` is present in every POST form. Flag AJAX calls that skip the CSRF token header.\n\nCheck that template variables containing HTML are escaped at the point of output, not at the point of storage. Flag `{{ variable|safe }}` where `variable` originates from user input at any point in the data flow.\n\n## Authentication and Authorization\n\nVerify `@login_required` or `LoginRequiredMixin` is applied to every view that should be protected. Flag views that check `request.user.is_authenticated` but still execute logic for unauthenticated users before the check.\n\nCheck permission decorators: `@permission_required` should use the correct permission string. Flag views that check `request.user.is_superuser` for authorization — use the permission system instead. Verify object-level permissions are checked when the view modifies or deletes specific objects.\n\n## Form and Serializer Validation\n\nVerify `form.is_valid()` is always called before accessing `form.cleaned_data`. Flag direct access to `request.POST` or `request.GET` without form validation. Check that custom form `clean_*` methods raise `ValidationError` with user-friendly messages.\n\nFor Django REST Framework: verify serializers validate all input fields. Flag `serializer.save()` calls without checking `serializer.is_valid(raise_exception=True)`. Check that `ModelSerializer` uses `fields` or `exclude` explicitly — never `fields = '__all__'` on models with sensitive fields.\n\n## Settings Security\n\nFlag `DEBUG = True` in any settings file used for production. Verify `SECRET_KEY` is loaded from an environment variable, not hardcoded. Check that `ALLOWED_HOSTS` is set to specific domains — not `['*']`.\n\nVerify `SECURE_SSL_REDIRECT`, `SESSION_COOKIE_SECURE`, `CSRF_COOKIE_SECURE` are `True` for production. Flag missing `SECURE_HSTS_SECONDS` setting.\n\n## Middleware Ordering\n\nVerify `SecurityMiddleware` is first. Check that `SessionMiddleware` comes before `AuthenticationMiddleware`. Flag `CorsMiddleware` placed after middleware that reads the response — it must be near the top to set headers on all responses.\n\nFor each finding, report: the file, the Django-specific pattern violated, and the recommended fix.\n",{"name":5,"license":15,"version":43,"triggers":44,"description":7},"2026.3.1",{"lenses":45,"keywords":46},[25,37,36],[19,21,47,22,48],"queryset","django rest framework","main","eac6069a8690d89fd23f08d2d14e4874ed376a77",".agent-orchestra\u002Fskills\u002Fdjango-review",0,"https:\u002F\u002Fgithub.com\u002Fmalayvuong\u002Fagent-orchestra","https:\u002F\u002Fgithub.com\u002Fmalayvuong","www.malayvuong.com","Just a newbie at everything","2026-10-09 12:52:45",{"source":8,"skillName":5,"commands":59,"prompt":69,"zipAvailable":70},[60,63,66],{"tool":61,"command":62},"npx","npx skills add malayvuong\u002Fagent-orchestra --skill \"Django Review\"",{"tool":64,"command":65},"bunx","bunx skills add malayvuong\u002Fagent-orchestra --skill \"Django Review\"",{"tool":67,"command":68},"pnpm","pnpm dlx skills add malayvuong\u002Fagent-orchestra --skill \"Django Review\"","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmalayvuong\u002Fagent-orchestra\u002Fblob\u002Fmain\u002F.agent-orchestra\u002Fskills\u002Fdjango-review\u002FSKILL.md",true,[],[73,110,129,147,171,190],{"skillNo":74,"name":75,"nameZh":6,"description":76,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":77,"categories":78,"keywords":95,"publishedAt":38},"01M6GXHYPRJ43SHFPFJTF87GS8","Vue.js Review","Deep review of Vue.js applications — Composition API patterns, reactivity traps, component design, Pinia state management, and performance pitfalls.","https:\u002F\u002Fgithub.com\u002Fmalayvuong\u002Fagent-orchestra\u002Fblob\u002Fmain\u002F.agent-orchestra\u002Fskills\u002Fvue-review\u002FSKILL.md",[79,84,87,90],{"categoryNo":80,"categoryName":81,"taxonomyType":82,"taxonomyTypeDesc":83},"01JBSEEDCAT000000000000009","前端开发","SCENARIO","使用场景",{"categoryNo":85,"categoryName":86,"taxonomyType":82,"taxonomyTypeDesc":83},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":88,"categoryName":89,"taxonomyType":82,"taxonomyTypeDesc":83},"01JBSEEDCAT000000000000015","视觉设计",{"categoryNo":91,"categoryName":92,"taxonomyType":93,"taxonomyTypeDesc":94},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[20,96,97,98,99,36,100,101,102,33,103,31,104,105,106,107,26,25,108,109],"vue","js","Vue js Review","design","component","state management","state","api patterns","api","Composition","pinia","management","pitfalls","pinia state",{"skillNo":111,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":114,"categories":115,"keywords":116,"publishedAt":38},"01M6GXHSPDDH1PQEN61ENMCEF5","Unity Review","Deep review of Unity C# code — object pooling, Update allocation, physics patterns, UI performance, serialization, and mobile optimization.","https:\u002F\u002Fgithub.com\u002Fmalayvuong\u002Fagent-orchestra\u002Fblob\u002Fmain\u002F.agent-orchestra\u002Fskills\u002Funity-review\u002FSKILL.md",[],[20,117,112,36,118,119,33,120,121,122,123,29,124,26,25,125,126,127,128],"unity","update","code","ui","serialization","Optimization","mobile","physics","C#","mobile optimization","object","allocation",{"skillNo":130,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":135,"publishedAt":38},"01M6GXHNKTH12CGSRWDGF2H1Q9","TypeScript Review","Deep review of TypeScript code — type safety, generics patterns, strict mode compliance, type narrowing, module boundaries, and common escape hatches.","https:\u002F\u002Fgithub.com\u002Fmalayvuong\u002Fagent-orchestra\u002Fblob\u002Fmain\u002F.agent-orchestra\u002Fskills\u002Ftypescript-review\u002FSKILL.md",[],[20,136,137,119,33,138,139,140,141,29,26,25,142,143,144,145,146],"typescript","typescript review","compliance","Type Safety","Safety","common","module","type","interface","consistency","mode",{"skillNo":148,"name":149,"nameZh":6,"description":150,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":151,"categories":152,"keywords":159,"publishedAt":38},"01M6GXHH3DMZD272RVH4800C67","Test Conventions","Testing patterns and conventions for code review. Covers naming, AAA structure, boundary testing, mock vs real dependencies, and coverage expectations.","https:\u002F\u002Fgithub.com\u002Fmalayvuong\u002Fagent-orchestra\u002Fblob\u002Fmain\u002F.agent-orchestra\u002Fskills\u002Ftest-conventions\u002FSKILL.md",[153,156],{"categoryNo":154,"categoryName":155,"taxonomyType":82,"taxonomyTypeDesc":83},"01JBSEEDCAT000000000000007","代码审查",{"categoryNo":157,"categoryName":158,"taxonomyType":82,"taxonomyTypeDesc":83},"01JBSEEDCAT000000000000008","测试与质量",[160,161,149,162,163,20,119,164,165,166,29,167,168,169,170],"test","conventions","code review","testing","testing patterns","boundary","coverage","dependencies","structure","mock","naming",{"skillNo":172,"name":173,"nameZh":6,"description":174,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":175,"categories":176,"keywords":181,"publishedAt":38},"01M6GXHCAQSJDVNVRFFD1HJWTN","Terraform Review","Deep review of Terraform\u002FOpenTofu configuration — state management, module design, security hardening, drift prevention, and production safety patterns.","https:\u002F\u002Fgithub.com\u002Fmalayvuong\u002Fagent-orchestra\u002Fblob\u002Fmain\u002F.agent-orchestra\u002Fskills\u002Fterraform-review\u002FSKILL.md",[177,180],{"categoryNo":178,"categoryName":179,"taxonomyType":82,"taxonomyTypeDesc":83},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":88,"categoryName":89,"taxonomyType":82,"taxonomyTypeDesc":83},[20,182,173,99,37,101,102,33,183,184,185,186,140,187,107,188,189,26,25,142],"terraform","cloud","aws","hardening","Production","opentofu","iac","drift",{"skillNo":191,"name":192,"nameZh":6,"description":193,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":194,"categories":195,"keywords":197,"publishedAt":38},"01M6GXH83F11CK4BQEAJPN6HDE","Swift Review","Deep review of Swift code — memory management, concurrency patterns, optionals, protocol design, SwiftUI lifecycle, and iOS platform patterns.","https:\u002F\u002Fgithub.com\u002Fmalayvuong\u002Fagent-orchestra\u002Fblob\u002Fmain\u002F.agent-orchestra\u002Fskills\u002Fswift-review\u002FSKILL.md",[196],{"categoryNo":88,"categoryName":89,"taxonomyType":82,"taxonomyTypeDesc":83},[198,20,192,99,199,36,119,200,33,201,202,203,204,205,107,26,25,206,207,208],"swift","memory","protocol","ios","concurrency","lifecycle","swiftui","uikit","xcode","apple","platform"]