← Back to Skills Marketplace
213
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install vnclaw-odoo-skill
Description
Integrate with Odoo 17 via XML-RPC API. Use when: managing projects, tasks, calendar events, time off requests, helpdesk tickets, knowledge articles, documen...
Usage Guidance
Before installing or enabling this skill: 1) Verify the registry metadata: request that the skill author declare required environment variables (ODOO_URL, ODOO_DB, ODOO_USERNAME, ODOO_API_KEY) so you know what secrets are needed. 2) Review scripts/odoo_core.py (not fully shown) to confirm blocked-model enforcement and that it does not exfiltrate data to unexpected endpoints. 3) If you must provide credentials, create an Odoo API key with the minimum required permissions for the user account (avoid using an admin account). 4) Be cautious about the SKILL.md 'ALWAYS run' rule — if you want to approve actions manually, disable autonomous invocation for the skill or change agent policies so the assistant must ask before executing local scripts. 5) Because the skill searches the filesystem to locate scripts (git rev-parse, find), consider installing it in a controlled location and confirm the path logic resolves to that location rather than allowing broad filesystem searches. 6) If you need stronger assurance, ask the author to: declare required env vars in registry metadata, provide a brief audit of odoo_core.py, and remove/soften the 'always execute' directive so the agent asks for confirmation before running commands.
Capability Analysis
Type: OpenClaw Skill
Name: vnclaw-odoo-skill
Version: 0.1.0
The vnclaw-odoo-skill bundle provides a comprehensive integration with Odoo 17 via XML-RPC. The core logic in odoo_core.py includes explicit security measures, such as a blocklist for sensitive models (e.g., ir.cron, ir.rule, res.groups) and a restriction against delete operations (unlink). While the SKILL.md instructions contain prompt-injection-like directives to 'ALWAYS run the command immediately' without user confirmation, these appear to be intended for a streamlined user experience rather than malicious bypass of oversight. The scripts use standard libraries and rely on user-configured environment variables for authentication, with no evidence of data exfiltration or unauthorized local execution.
Capability Assessment
Purpose & Capability
Name, README, SKILL.md, and the included scripts all implement Odoo XML-RPC integration (tasks, projects, timesheets, calendar, helpdesk, documents, knowledge, custom models). The required environment variables (ODOO_URL, ODOO_DB, ODOO_USERNAME, ODOO_API_KEY) are appropriate for this purpose. However the registry metadata lists no required environment variables / no primary credential — that is inconsistent with the skill's own documentation and code which clearly expect credentials.
Instruction Scope
SKILL.md instructs the agent to 'ALWAYS run the command immediately' and never prompt the user — i.e., automatically translate user intent into local script execution. The path-resolution snippet scans for repository roots (git rev-parse) and searches the filesystem (find $HOME /opt) to locate the scripts, which is broader filesystem access than a simple localized script invocation. The scripts themselves call out to Odoo via connect()/execute(); they also provide a generic custom_app.py allowing read/create/update on arbitrary models. While this is within the claimed feature set, the 'always execute without confirmation' rule plus filesystem discovery expands the runtime scope and increases risk if you expect a confirmation step.
Install Mechanism
There is no install specification (instruction-only), which reduces supply-chain risk. However the package contains multiple Python scripts that are expected to be present on disk at known locations; the skill assumes those files exist in workspace or user skill directories and includes logic to search for them. No external downloads or installers are specified.
Credentials
The environment variables declared inside SKILL.md (ODOO_URL, ODOO_DB, ODOO_USERNAME, ODOO_API_KEY) are reasonable and proportionate to an Odoo XML-RPC client. The concern is that the registry metadata did not declare any required env vars or primary credential — a mismatch that could hide the need to provide secrets. Also the scripts will stop if env vars are missing (per execution rules), but the skill's path-discovery and generic custom_app capabilities mean those credentials (if provided) could be used to query or modify many models; ensure the API key has least-privilege.
Persistence & Privilege
The skill is not always:true and does not request elevated platform-wide privileges. However the runtime instructions encourage autonomous execution (never ask user to confirm), which combined with an agent allowed to invoke skills autonomously increases the blast radius. This is not disallowed by the platform defaults, but it's a security consideration when combined with the other concerns above.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install vnclaw-odoo-skill - After installation, invoke the skill by name or use
/vnclaw-odoo-skill - Provide required inputs per the skill's parameter spec and get structured output
Version History
v0.1.0
Initial release of vnclaw-odoo-skill: Odoo 17 integration
- Integrate with Odoo 17 using XML-RPC API for project, task, calendar, helpdesk, knowledge, documents, and timesheet management.
- Supports read, create, and update actions (no delete).
- Natural language requests are mapped directly to script commands—no confirmation required.
- Resolves skill scripts from both workspace and global user locations.
- Handles all credential/setup errors strictly via environment variables.
- Features include user/name-based filtering, date shortcuts, custom date range, activity logging, notifications, and consistent JSON output across modules.
Metadata
Frequently Asked Questions
What is VNClaw Odoo Skill?
Integrate with Odoo 17 via XML-RPC API. Use when: managing projects, tasks, calendar events, time off requests, helpdesk tickets, knowledge articles, documen... It is an AI Agent Skill for Claude Code / OpenClaw, with 213 downloads so far.
How do I install VNClaw Odoo Skill?
Run "/install vnclaw-odoo-skill" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is VNClaw Odoo Skill free?
Yes, VNClaw Odoo Skill is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does VNClaw Odoo Skill support?
VNClaw Odoo Skill is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created VNClaw Odoo Skill?
It is built and maintained by DVNghiem (@dvnghiem); the current version is v0.1.0.
More Skills