Labsco
microsoft logo

jinja2

✓ Official★ 2,433

by microsoft · part of microsoft/debugpy

Best practices for template rendering with Jinja2 including environments, filters, autoescaping, and security.

🔥🔥🔥🔥✓ VerifiedFreeQuick setup
#git#security
🧰 Not standalone. This skill ships with microsoft/debugpy and only works together with that tool — install the tool first, then add this skill.

This is the playbook your agent receives when the skill activates — you don't need to read it to use the skill, but it's here to audit before installing.

Skill: Jinja2

Best practices for template rendering with Jinja2 including environments, filters, autoescaping, and security.

When to Use

Apply this skill when rendering templates with Jinja2 — HTML pages, emails, configuration files, and code generation.

Environment

  • Create a jinja2.Environment(loader=..., autoescape=...) once and reuse it.
  • Use FileSystemLoader for file-based templates, PackageLoader for installed packages.
  • Enable autoescape=True for HTML templates to prevent XSS.

Templates

  • Use {{ variable }} for output, {% if/for/block %} for control flow.
  • Use template inheritance ({% extends 'base.html' %}) for layout reuse.
  • Define custom filters for reusable transformations.

Security

  • Always enable autoescape=True when rendering HTML.
  • Use SandboxedEnvironment for untrusted templates.
  • Never render user input as template code — only as template data.
  • Use |e filter explicitly when autoescape is off.

Pitfalls

  • Don't use Template(string) directly — it bypasses the environment's loader and settings.
  • Watch for undefined variable errors — use undefined=StrictUndefined during development.
  • Avoid complex logic in templates — keep them focused on presentation.