Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/actinon-com/brass-monkey/odoo-devnpx skills add actinon-com/brass-monkey --skill odoo-devgit clone --depth 1 https://github.com/actinon-com/brass-monkeyWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00034 | $0.00970 |
| Opus 5 | $0.00017 | $0.00485 |
| Sonnet 5 | $0.00007 | $0.00194 |
| Haiku 4.5 | $0.00003 | $0.00097 |
Grade A, and why
odoo-dev scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 59 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skill: Odoo Development & Customization
This skill provides the agent with high-level technical expertise in Odoo's customization engine, covering Server Actions, Automated Rules, and Odoo Studio modifications.
Core Mandates
1. Snapshot Awareness (Technical Discovery)
- Mandate: The
dev-fields.jsonresource is a snapshot of common technical models. - Verification: If troubleshooting an error related to a custom module or a specific Odoo version, you MUST call
inspect_modelto retrieve the current, live schema. Custom fields added via Studio or third-party code will only be visible via live introspection.
2. Identify Customizations (Odoo Studio)
Before troubleshooting or proposing changes, the agent must identify existing low-code customizations:
- Custom Fields: Look for fields prefixed with
x_(e.g.,x_studio_customer_type). - Custom Models: Look for technical models prefixed with
x_(e.g.,x_service_agreement). - Custom Views: Studio modifications are stored in the database (
ir.ui.view). Check for views with a name containing "studio" or aninherit_idpointing to a standard view.
2. Server Actions (ir.actions.server)
- Purpose: Execute Python code, update records, or trigger multi-step workflows via the UI.
- Mandate: When writing Python code in a Server Action, ensure all variables (
env,model,record,records,time) are used correctly. Avoid long-running loops or operations that could cause database locks. - HTML Communication: If using
message_postwithin a Server Action to send HTML, remember to passbody_is_html=Trueto prevent escaping.
Running one (execute_action)
- Inspect before you run. A server action is a mutable data row, so its name tells you nothing
about its effect. ALWAYS call
execute_actionwithdry_run: truefirst for an action you have not run before: the report expands the fullchild_idstree and classifies every step. - Unsafe states are blocked by default.
code(arbitrary Python),webhook,mail_postandsmsrequireacknowledge_unsafe: true. Before setting it, explain to the user in your message exactly what the action does — for acodeaction, quote the Python from the dry-run report. - A
multiaction is only as safe as its children. The classification covers the whole expanded tree, so a wrapper containing one Python step is treated as Python. - Targets are explicit. Pass
ids. An empty recordset is refused unless you setallow_empty_recordset: true, because many actions fall back to acting on everything in scope. - Follow-up actions are inert. If the action returns another action, it is handed back as data and is NOT executed. Decide deliberately whether to act on it.
- Snapshots are honest. Only declarative states (
object_write,object_create,update) can be snapshotted. For anything else the audit entry records that no before-state was capturable rather than implying nothing changed — so recovery planning is on you.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 59 lines · 34 tokens per session scan A 9603d111115e
odoo-dev is a skill published in the GitHub repository actinon-com/brass-monkey (2 stars, last pushed 10d ago), licensed MIT. It adds 34 tokens to every session and 970 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
deploy-able
Drive an Able Desk deployment onto the user's own Cloudflare account, in order, stopping at every step only a human can complete. Use when the user wants to deploy Able, set it up for their business, stand up a support desk, resume a half-finished deployment, or check what is left before real customers can be served.
mcp-scripting
Write mcpScript JavaScript for discovering, inspecting, and calling MCP tools.
gcloud-usage
This skill should be used when user asks about "GCloud logs", "Cloud Logging queries", "Google Cloud metrics", "GCP observability", "trace analysis", or "debugging production issues on GCP".
spk-team-auth
Handle Spec Kitty team authentication, hosted credentials, account selection, and auth-related recovery.
setup
This skill should be used when user encounters "Azure MCP error", "Azure authentication failed", "az login required", "Azure CLI not found", or needs help configuring Azure MCP integration.
review-queue
Ревью открытых PR ivanarama/onebase перед мержем — независимый разбор диффа с прогоном сборки и тестов, заключение комментарием, метки reviewed / changes-requested. Этап конвейера сопровождения, запускается по расписанию через PromptPilot.