skills/openaec-foundation/erpnext_anthropic_claude_development_skill_package/erpnext-impl-serverscripts/Gen Agent Trust Hub
erpnext-impl-serverscripts
Pass
Audited by Gen Agent Trust Hub on Mar 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill focuses on secure development practices for the Frappe/ERPNext framework. It provides implementation workflows that include mandatory permission checks and validation logic.
- [SAFE]: The 'Anti-Patterns' reference in
references/anti-patterns.mdprovides high-quality security guidance, educating users on how to avoid SQL injection via parameterized queries, prevent sandbox escapes, and avoid the N+1 query problem. - [PROMPT_INJECTION]: The skill templates establish an ingestion surface for external data through the implementation of custom API endpoints.
- Ingestion points: Untrusted user data is captured via
frappe.form_dictinSKILL.md(Workflow 4) andreferences/examples.md(Example 6). - Boundary markers: While explicit text delimiters are not used, the templates implement logical validation and permission checks (
frappe.has_permission) to manage data flow. - Capability inventory: The provided patterns have the capability to perform database operations via
frappe.db, manage system documents viafrappe.get_doc, and send communications viafrappe.sendmail. - Sanitization: Robust sanitization and validation are standard throughout the skill, including the use of
frappe.db.escape, parameterized SQL queries, and input type casting (e.g.,cint).
Audit Metadata