Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →xu-xiang/django-security
Django 安全最佳实践，涵盖身份验证、授权、CSRF 防护、SQL 注入预防、XSS 预防以及安全部署配置。
Passed 24 of 24 test cases with the skill, and 23 of 24 without it.
1 fixed23 passed either way0 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
A test case the skill fixed. Same model, same prompt, with and without the skill.
A Django form allows users to upload document files. To prevent executable uploads, how should a custom validator extract and verify the file extension using Python's standard library before checking against an allowed extension list?
| Checked | Without skill | With skill |
|---|---|---|
| uses os.path.splitext on value.name | Missed | Passed |
| raises ValidationError if extension is not in allowed list | Passed | Passed |
The instructions your model reads when the skill loads.
针对 Django 应用程序的全面安全指南，旨在防范常见脆弱性。
# settings/production.py
import os
DEBUG = False # 重要：在生产环境中绝对不要设置为 True
ALLOWED_HOSTS = os.environ.get('ALLOWED_HOSTS', '').split(',')
# 安全响应头（Security Headers）
SECURE_SSL_REDIRECT = True
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SECURE = True
SECURE_HSTS_SECONDS = 31536000 # 1年
SECURE_HSTS_INCLUDE_SUBDOMAINS = True
SECURE_HSTS_PRELOAD = True
SECURE_CONTENT_TYPE_NOSNIFF = True
SECURE_BROWSER_XSS_FILTER = True
X_FRAME_OPTIONS = 'DENY'
# HTTPS 与 Cookie
SESSION_COOKIE_HTTPONLY = True
CSRF_COOKIE_HTTPONLY = True
SESSION_COOKIE_SAMESITE = 'Lax'
CSRF_COOKIE_SAMESITE = 'Lax'
test cases passed, vs 23 / 24 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.