The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes external CLI tools and scripts within the local environment to manage the documentation workflow.\n
Several scripts (odoo-guide-doctor, odoo-guide-init, odoo-guide-render) utilize subprocess.run to execute sibling project scripts, specifically odoo-ai and build_report.py located in adjacent directories (../../odoo-introspect/ and ../../html-report/). These executions are used for environment introspection and report generation.\n
The odoo-guide-run script performs dynamic code execution by injecting JavaScript strings (_ANNOTATE_JS, _DECLUTTER_JS, _CLEAR_JS) into the browser context via Playwright's page.evaluate to highlight UI elements and remove debug banners.\n- [DATA_EXFILTRATION]: The skill performs network operations to interact with Odoo instances as part of its primary functionality.\n
It utilizes the xmlrpc.client library to interact with Odoo's XML-RPC API for gathering grounding metadata (view architectures, access rights) and verifying record states.\n
It uses Playwright to automate browser sessions on target Odoo URLs provided by the user to capture step-by-step screenshots.\n- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it processes untrusted data from the Odoo user interface to generate prose.\n
Ingestion points: The agent ingests Odoo UI elements such as button labels, menu text, and form view metadata through both Playwright accessibility trees and XML-RPC architectures (specifically in odoo-guide-prep and odoo-guide-run).\n
Boundary markers: The skill does not implement explicit boundary markers or instructions to the agent to disregard potential instructions embedded within Odoo UI text fields.\n
Capability inventory: The skill possesses capabilities for filesystem access (writing reports/screenshots), network communication (XML-RPC), and subprocess execution.\n
Sanitization: The odoo-guide-render script utilizes html.escape to sanitize data before embedding it in the final HTML report, providing protection against simple markup injection.

odoo-user-guide