skills/team/python-feature-slice/SKILL.md
Scaffolds feature-based Python architecture using FastAPI routers, Pydantic v2 models, and a service layer. Python analog of dotnet-vertical-slice — no mediator library, uses FastAPI Depends() for dependency injection and structural CQRS conventions. Use when creating feature-based Python projects, adding FastAPI features, scaffolding service layers, or organizing Python code by feature. Triggers on phrases like "scaffold python feature", "create python slice", "fastapi feature folder", "python vertical slice", "add python endpoint", "python feature architecture", "python service layer".
npx skillsauth add michaelalber/ai-toolkit python-feature-sliceInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
"Organize around business capabilities, not technical layers." -- Sam Newman, Building Microservices
Feature slice architecture organizes code by business capability, not technical layer: instead of
controllers/, services/, repositories/, you have features/orders/, features/users/ — each a
self-contained vertical slice. In Python with FastAPI, the mediator pattern (FreeMediator in .NET) is
replaced by FastAPI's native Depends(); service classes are injected directly into route handlers.
CQRS separation is a structural/naming convention — OrderReadService vs OrderWriteService — not a
library contract.
Non-Negotiable Constraints:
shared/ domain models.response_model set; no bare dict returns.typing.Protocol for service interfaces so tests run without concrete implementations.async def; no blocking calls in async context (asyncio.to_thread() if unavoidable).Full principle table, KB lookups, discipline rules, anti-patterns, and error recovery live in
references/conventions.md.
DETECT Identify existing structure (flat/layered/feature-based), the FastAPI entry point
(main.py/app.py), the router registration pattern, the ORM setup, and the auth pattern.
(grep APIRouter/include_router; find main.py/app.py.)
SCAFFOLD Create the feature package:
features/<name>/{__init__.py, router.py, service.py, models.py, dependencies.py}
tests/features/<name>/{test_router.py, test_service.py}
(File-by-file content in references/feature-folder-template.md; read/write split in cqrs-conventions.md.)
REGISTER Wire the router: app.include_router(<name>_router, prefix="/api/v1", tags=["<name>"]).
VERIFY uvicorn starts; /docs renders the endpoints; pytest tests/features/<name>/ passes;
grep confirms no cross-feature imports.
Exit criteria: feature package created with thin router, Protocol-typed read/write services,
Pydantic v2 models, and tests; router registered under /api/v1; app starts, /docs renders, tests
pass, and no cross-feature imports exist.
<python-feature-slice-state>
phase: DETECT | SCAFFOLD | REGISTER | VERIFY | COMPLETE
feature_name: [name]
existing_structure: flat | layered | feature-based | unknown
app_entry_point: [file path]
router_registered: true | false
tests_scaffolded: true | false
read_service_created: true | false
write_service_created: true | false
last_action: [description]
next_action: [description]
</python-feature-slice-state>
references/output-templates.md.references/feature-folder-template.md.references/cqrs-conventions.md.references/conventions.md.| Skill | Relationship |
|-------|-------------|
| fastapi-scaffolder | Endpoint-level scaffolding (OpenAPI metadata, security, rate limiting). Use together for full endpoint quality within a feature. |
| alembic-migration-manager | When a feature needs schema changes, use it for the migration lifecycle. |
| python-security-review | After scaffolding, verify the feature's authentication, authorization, and input validation. |
| python-architecture-checklist | Quality gate — run after several features to verify isolation and coupling metrics. |
development
Federal / government security overlay applied ON TOP OF a base language security review (dotnet/python/php/rust/react). Language-agnostic: adds NIST SP 800-53 control mapping, FIPS 140-2/3 cryptographic compliance (with a per-language crypto table), CUI handling, EO 14028 supply-chain requirements, and DOE Order 205.1B, and emits POA&M-ready findings with FIPS 199 impact levels. Use for federal/DOE/DOD/national-laboratory systems. Triggers on "federal security review", "NIST compliance", "NIST 800-53", "FISMA", "CUI", "FIPS audit", "DOE security", "POA&M", "ATO review". Do NOT use alone — run the matching <lang>-security-review FIRST; this overlay maps and extends it.
tools
OWASP-based security review of React / TypeScript front-end applications. Detects the framework (Vite/CRA/Next), entry points, and data flows, scans against the OWASP Top 10 (2025) mapped to React client-side patterns (XSS via raw HTML, URL/protocol injection, secrets in the bundle, insecure token storage, dependency CVEs, missing CSP, open redirects), and produces a manager-friendly executive summary plus a graded technical findings table. Use to audit React code for vulnerabilities. Triggers on "react security review", "frontend security audit", "audit react for vulnerabilities", "owasp react", "react xss", "react security posture", "npm audit review". For federal / gov / DOE / NIST / FIPS / CUI context, run security-review-federal after this base review. Do NOT use to grade architecture/structure — use react-architecture-checklist.
tools
Analyzes legacy React codebases and produces actionable modernization plans. Primary migration paths include class components to function components + hooks, Create React App to Vite, React 16/17 to 18 to 19, JavaScript to TypeScript, Enzyme to React Testing Library, legacy Redux to Redux Toolkit / Zustand / Context, and deprecated lifecycle/API removal. Does NOT perform the migration — assesses, quantifies risk, and plans. Triggers on phrases like "modernize react", "class to hooks", "upgrade react", "migrate CRA to vite", "react legacy migration", "react 17 to 18", "react js to typescript", "react technical debt", "enzyme to RTL".
development
Scaffolds feature-based React / TypeScript architecture using feature folders, presentational + container components, custom hooks, a typed data layer, and structural CQRS (query hooks vs mutation hooks). React analog of dotnet-vertical-slice and python-feature-slice — no DI framework; uses props/context for dependency injection and a query cache for server state. Use when creating feature-based React projects, adding React features, organizing components by feature rather than by technical type, or scaffolding a feature's data layer. Triggers on phrases like "scaffold react feature", "create react slice", "react feature folder", "react vertical slice", "add react feature", "react feature architecture", "organize react by feature".