The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides instructions for processing Odoo XML templates and JavaScript components, which are ingestion points for potentially untrusted code or data.
Ingestion points: Odoo manifest files (__manifest__.py), XML templates (static/src/xml), and JavaScript source files (static/src/js).
Boundary markers: The instructions explicitly warn to treat unsafe HTML as a "security boundary" and require user confirmation before executing commands that affect the local environment.
Capability inventory: The skill guides code modifications and suggests running Odoo frontend tests and asset builds.
Sanitization: The skill promotes framework-standard sanitization, such as using t-out for automatic escaping and cautioning against the use of markup for raw HTML output.
[SAFE]: The skill is strictly instructional and focused on developer productivity within the Odoo ecosystem. It does not contain obfuscated code, remote execution patterns, or unauthorized access to sensitive data.

odoo-owl