The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes a local Python script scripts/scaffold.py and instructions for the agent to execute it. This script is used to generate Odoo module boilerplates by copying templates from the local assets/ directory. The script incorporates input validation using regular expressions for module names and versions.
[DATA_EXPOSURE]: The agent is authorized to read local documentation files in the references/ folder. This is intended behavior to provide the agent with the necessary context for Odoo and OCA coding standards.
[PROMPT_INJECTION]: The system prompt includes defensive instructions that prioritize security, such as explicitly forbidding cr.commit() calls and raw SQL string concatenation to prevent SQL injection.
[SAFE]: An indirect prompt injection surface exists as the agent processes user requirements to generate code. However, the risk is mitigated by the skill's internal instructions and the sanitization logic within the provided scaffolding script.
Ingestion points: User-provided module names, versions, and functional requirements.
Boundary markers: None explicitly defined in the prompt instructions.
Capability inventory: Execution of the local scripts/scaffold.py script, which performs file system writes and directory creation.
Sanitization: The scripts/scaffold.py script uses regex validation ([a-z0-9_]+) for technical names and versions to prevent malformed input.

odoo-dev