Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ericrisco/rsc-harness --skill djangogit clone --depth 1 https://github.com/ericrisco/rsc-harnessWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ericrisco/rsc-harness/django)<a href="https://agentmods.dev/skills/ericrisco/rsc-harness/django"><img src="https://agentmods.dev/badge/skills/ericrisco/rsc-harness/django/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ericrisco/rsc-harness/django"><img src="https://agentmods.dev/badge/skills/ericrisco/rsc-harness/django.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00084 | $0.03178 |
| Opus 5.5 | $0.00034 | $0.01271 |
| Sonnet 5.5 | $0.00017 | $0.00636 |
| Haiku 4.5 | $0.00008 | $0.00318 |
Grade A, and why
django scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 264 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Django web applications
The single authoritative skill for building, reviewing, securing, testing and shipping a Django app — the batteries-included, ORM-first, request/response Python framework.
Mental model: a Django project is apps composed of fat-but-thin-enough models (domain + query logic on the model/manager), views that orchestrate (FBV/CBV/DRF) and never own SQL, an admin/forms layer, and a settings module split by environment. The ORM, migrations, auth, admin, CSP and the test runner are all first-party. Reach for the framework before you add a dependency.
Pinned stack (2026-06)
- Django 5.2 LTS — the production default. Released 2025-04-02, security fixes until
~April 2028, supports Python 3.10–3.14. New in 5.2: all models auto-imported in
shell,CompositePrimaryKey,BoundFieldcustomization. - Django 6.0 — released 2025-12-03 (non-LTS, ~8 months until 6.1). Choose it only when you
want the new built-in Tasks framework (background jobs without Celery) or native CSP
(
ContentSecurityPolicyMiddleware,SECURE_CSP) and can take the shorter support window. Drops Python 3.10/3.11; supports 3.12–3.14. - Django REST Framework 3.17.1 (2026-03-24) — adds Django 6.0 + Python 3.14 support.
- Python 3.12+,
pytest-django,factory_boy. ruff/uv and type-hint policy live inpython.
Version rule: default to 5.2 LTS. Pick 6.0 only for a concrete Tasks/CSP need, and say so.
Route elsewhere
| Situation | Route to |
|---|---|
Async service, fastapi/pydantic/uvicorn, async SQLAlchemy |
fastapi |
| Postgres schema design, EXPLAIN ANALYZE, indexing strategy, RLS, pooling | postgresdb |
| Cross-stack OWASP/STRIDE threat modeling | secure-coding |
| Container/Compose/CI, gunicorn prod tuning, collectstatic pipeline | deployment |
| REST contract design (cursor vs offset, status codes, versioning) | api-design |
| ruff/uv/general type hints, packaging | python |
Project shape
Split settings by environment; never ship one settings.py toggled by DEBUG.
What ships with it
7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 264 lines · 84 tokens per session scan A a4b8e40e1c83
django is a skill published in the GitHub repository ericrisco/rsc-harness (231 stars, last pushed yesterday), licensed MIT. It adds 84 tokens to every session and 3,178 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
django-expert
Expert-level Django development for robust Python web applications with ORM, admin, and authentication. Use when the user mentions Python, web, ORM, MVC, or Django REST Framework, or when the task involves Django Architecture.
django
Build Django models, views, routes, and admin features; review ORM queries, migrations, and deployment settings.
Django Testing Patterns
Django application testing with TestCase, fixtures, factoryboy, model testing, view testing, middleware testing, and Django REST framework testing.
fastapi-templates
Create production-ready FastAPI projects with async patterns, dependency injection, and comprehensive error handling. Use when building new FastAPI applications or setting up backend API projects.
supabase-python
FastAPI with Supabase and SQLAlchemy/SQLModel.
hunt-django
Hunt Django-specific vulnerabilities: DRF permission gaps, ORM injection, and admin exploitation.