django-reviewer_skill

Overview

This skill reviews Django projects to find performance issues, security risks, and maintenance problems across ORM usage, views, templates, admin, and migrations. It produces actionable recommendations to optimize queries, restructure business logic, secure templates, and make migrations safe. The output highlights severity and file locations so you can prioritize fixes quickly.

How this skill works

It scans project indicators (requirements, manage.py, settings.py, urls.py, views.py, models.py) to detect a Django codebase and inspects ORM patterns, view structure, template usage, model design, admin configuration, and migrations. For each finding it reports severity (CRITICAL/HIGH/MEDIUM/LOW), explains the issue, and gives concrete code-level remediation such as select_related/prefetch_related, service extraction, CSRF/JSON encoding fixes, and safe migration sequences. Recommendations are framed to be actionable and prioritized.

When to use it

• Before releases to catch N+1 queries, unindexed filters, and heavy migrations
• During code review for new views or refactors to enforce patterns and permissions
• When you suspect template XSS, unsafe |safe usage, or missing CSRF tokens
• When preparing schema changes to ensure zero-downtime migrations
• When hardening admin customizations and model representations in the admin UI

Best practices

• Detect and fix N+1 queries with select_related for FK and prefetch_related for M2M/reverse FK
• Keep business logic out of views—use service/manager layers and Class-Based Views with Mixins
• Treat templates as untrusted: avoid |safe, prefer json_script for JS, and always include {% csrf_token %}
• Design models with explicit max_length, db_index for filtered fields, and useful __str__ and Meta ordering
• Split schema and data migrations: add nullable fields first, populate data, then make fields non-nullable

Example use cases

• A pull request contains new list views that may cause N+1 queries; run the skill to get select_related suggestions
• A team plans a large schema change; run migration safety checks to recommend a zero-downtime strategy
• An admin customization shows slow pages; detect missing indexes and poor queryset usage
• A template injects user content into JavaScript; get json_script and escaping fixes to prevent XSS
• Hardening a legacy app: identify views missing permission checks and recommend LoginRequired/PermissionMixins