Security review and implementation guidance for Odoo website, portal, public controllers, JSON routes, QWeb output, and browser-facing assets. Use when exposing Odoo data over HTTP, adding portal/public pages or forms, using sudo, handling tokens, rendering HTML, or reviewing web attack surfaces.
The English summary is being prepared. Showing the original description.
See how to installReview the instructions the agent will receive before you install.
Use this skill at every Odoo web trust boundary. Compose it with odoo-website, odoo-code-review, and the version-specific Odoo skill.
Identify the caller, authentication mode, record being accessed, mutation being performed, and data that crosses the browser boundary. Treat route parameters, query strings, form fields, JSON payloads, headers, cookies, and browser state as attacker-controlled.
Read SECURITY-CHECKLIST.md before editing or approving a web-facing change.
auth='public' is not a substitute for a publication policy.sudo() must be narrow, justified, and followed by an explicit visibility check.For each finding, state the attacker, entry point, missing control, affected data/action, and a concrete test that would fail before the fix.
No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Interview the user relentlessly about a plan or design until reaching shared understanding, resolving each branch of the decision tree. Use when the user wants to stress-test a plan, get grilled on their design, or mentions "grill me" outside an Odoo-specific context.
The English summary is being prepared. Showing the original description.
Grilling session that challenges your plan against the existing domain model, sharpens terminology, and updates documentation (CONTEXT.md, ADRs) inline as decisions crystallise. Use when the user wants to stress-test a plan against their project's language and documented decisions.
The English summary is being prepared. Showing the original description.
Find deepening opportunities in a codebase, informed by the domain language in CONTEXT.md and the decisions in docs/adr/. Use when the user wants to improve architecture, find refactoring opportunities, consolidate tightly-coupled modules, or make a codebase more testable and AI-navigable.
The English summary is being prepared. Showing the original description.
Odoo engineering workflows for addon development, codebase exploration, debugging, architecture/refactor review, manifest/docs sync, and routing to migration work. Use when the user mentions Odoo, addons, modules, manifests, models, XML views, security CSVs, record rules, Odoo shell, OWL/QWeb/assets, or when an Odoo codebase is detected.
The English summary is being prepared. Showing the original description.
Odoo 17 development reference for Python models and ORM (search, domain, read_group, compute fields), XML/CSV data and views, OWL/JS client code, QWeb reports, security (ACL, record rules, groups), cron and server actions, migrations and module upgrades, tests, i18n, and performance. Use this skill whenever work involves Odoo 17 or custom addons, including traceback diagnosis, addons, manifests, XML errors, HTTP controllers, business rules, feature work, refactoring, or reviews.
The English summary is being prepared. Showing the original description.
Odoo 18 development reference for Python models and ORM (search, domain, read_group, compute fields), XML/CSV data and views, OWL/JS client code, QWeb reports, security (ACL, record rules, groups), cron and server actions, migrations and module upgrades, tests, i18n, and performance. Use this skill whenever work involves Odoo 18 or custom addons, including traceback diagnosis, addons, manifests, XML errors, HTTP controllers, business rules, feature work, refactoring, or reviews.
The English summary is being prepared. Showing the original description.