python_skill

Overview

This skill covers secure, high-performance Python backend development for the JARVIS AI Assistant, focused on security, maintainability, and scalability. It codifies best practices for type safety, async I/O, secure defaults, and test-driven development. The guidance targets services that handle authentication, data storage, file operations, and external integrations.

How this skill works

The skill inspects and prescribes concrete patterns: validated input models, safe database access, secure subprocess and file handling, and robust cryptography. It enforces a TDD-first workflow with verification gates (tests, type checks, dependency audits) and integrates performance patterns like async concurrency, generators, and connection pooling. Security checks include static analysis, dependency audits, and targeted security tests.

When to use it

• Building or hardening web APIs with FastAPI or Starlette
• Implementing database-backed services using SQLAlchemy/asyncpg
• Processing user-supplied files or running subprocesses
• Adding authentication, password storage, or cryptographic operations
• Ensuring CI enforces type checks, security scans, and tests

Best practices

• Start with failing tests (TDD) and keep the minimal implementation to pass them
• Use pydantic models and type hints; validate at runtime boundaries
• Favor async patterns (asyncio.gather, connection pooling) for I/O throughput
• Never format SQL by string interpolation; use parameterized queries or ORM expressions
• Store secrets in environment or secret managers; never hardcode keys
• Run bandit, pip-audit/safety, and mypy as part of CI

Example use cases

• User service that validates signup with strict email and password rules and Argon2 hashing
• Batch import that uses chunked bulk inserts to avoid memory and DB bottlenecks
• Concurrent API calls to third-party services using asyncio.gather and httpx
• Secure file read endpoints that prevent path traversal using pathlib.resolve checks
• Admin utilities that only run allowed subprocesses with list args and timeouts