# Jinja2

> Best practices for template rendering with Jinja2 including environments, filters, autoescaping, and security.

- Skill: `microsoft/jinja2` (Agent Skill)
- Install (CLI): `npx skillmds@latest add microsoft/jinja2`
- Raw SKILL.md: https://api.skillmd.com/api/skills/microsoft/jinja2/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: Microsoft (https://skillmd.com/u/microsoft)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/microsoft/jinja2

---


# Skill: Jinja2

Best practices for template rendering with Jinja2 including environments, filters, autoescaping, and security.

## When to Use

Apply this skill when rendering templates with Jinja2 — HTML pages, emails, configuration files, and code generation.

## Environment

-   Create a `jinja2.Environment(loader=..., autoescape=...)` once and reuse it.
-   Use `FileSystemLoader` for file-based templates, `PackageLoader` for installed packages.
-   Enable `autoescape=True` for HTML templates to prevent XSS.

## Templates

-   Use `{{ variable }}` for output, `{% if/for/block %}` for control flow.
-   Use template inheritance (`{% extends 'base.html' %}`) for layout reuse.
-   Define custom filters for reusable transformations.

## Security

-   **Always** enable `autoescape=True` when rendering HTML.
-   Use `SandboxedEnvironment` for untrusted templates.
-   Never render user input as template code — only as template data.
-   Use `|e` filter explicitly when autoescape is off.

## Pitfalls

-   Don't use `Template(string)` directly — it bypasses the environment's loader and settings.
-   Watch for undefined variable errors — use `undefined=StrictUndefined` during development.
-   Avoid complex logic in templates — keep them focused on presentation.