Security checks across malware telemetry and agentic risk
This ERP skill is mostly coherent with its stated purpose, but it needs review because it can run scheduled financial actions, execute downloaded modules, and perform host-level web dashboard deployment.
Install only if you are comfortable with a broad local ERP skill that can mutate business, payroll, inventory, and accounting records. Review and restrict module installation/update, setup-web-dashboard, deploy-module, schema rollback/apply, restore, cleanup, submit/cancel/approve, and scheduled recurring actions. Avoid using the dashboard setup on a production server unless you have reviewed the cloned web project and accept the nginx/systemd/TLS changes.
args[i + 1] = action_override
break
os.execvp(sys.executable, [sys.executable, script] + args)
def _suggest_module_for_action(action):elif val is not False:
cmd.extend([flag, str(val)])
result = subprocess.run(
cmd, capture_output=True, text=True, timeout=120
)Uses subprocess.run with capture. Never raises — returns status.
"""
try:
result = subprocess.run(
cmd,
cwd=cwd,
capture_output=True,return {"passed": True, "detail": "No test files found — skipped"}
try:
result = subprocess.run(
[sys.executable, "-m", "pytest", test_dir, "-q", "--tb=line", "-x", "--timeout=30"],
capture_output=True,
text=True,else:
test_env["PYTHONPATH"] = erpclaw_lib
proc = subprocess.run(
[sys.executable, "-m", "pytest", test_dir, "-q", "--tb=short"],
capture_output=True,
text=True,if init_db_path:
# Module init_db.py typically takes db_path as first positional arg
# or via --db-path flag. Try positional arg first (most common pattern).
proc = subprocess.run(
[sys.executable, init_db_path, db_path],
capture_output=True,
text=True,)
if proc.returncode != 0:
# Retry with --db-path flag
proc = subprocess.run(
[sys.executable, init_db_path, "--db-path", db_path],
capture_output=True,
text=True,)
if os.path.exists(gl_script):
try:
result = subprocess.run(
[sys.executable, gl_script,
"--action", "setup-chart-of-accounts",
"--company-id", company_id,)
if os.path.exists(erpclaw_script):
try:
result = subprocess.run(
[sys.executable, erpclaw_script,
"--action", "seed-demo-data"],
capture_output=True, text=True, timeout=120import tempfile
tmp_dir = tempfile.mkdtemp(prefix=f"erpclaw-install-{module_name}-")
try:
result = subprocess.run(
["git", "clone", "--depth", "1", "--filter=blob:none",
"--sparse", clone_url, tmp_dir],
capture_output=True, text=True, timeout=120else:
# Standalone repo — clone directly
try:
result = subprocess.run(
["git", "clone", "--depth", "1", clone_url, install_path],
capture_output=True, text=True, timeout=120
)tables_created = 0
if os.path.isfile(init_db_path):
try:
result = subprocess.run(
[sys.executable, init_db_path],
capture_output=True, text=True, timeout=60
)# Pull latest
try:
result = subprocess.run(
["git", "pull", "origin", "main"],
cwd=install_path, capture_output=True, text=True, timeout=60
)init_db_path = os.path.join(install_path, "init_db.py")
if os.path.isfile(init_db_path):
try:
subprocess.run(
[sys.executable, init_db_path],
capture_output=True, text=True, timeout=60
)64/64 vendors flagged this skill as clean.