Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Frappe MCP

Pre-defined business workflows combining multiple MCP tools for CRM, sales, purchase, inventory, project, payments, and utility tasks in ERPNext.

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 508 · 1 current installs · 1 all-time installs
byPathurjan Wijeyasekara@Ravana-indus
MIT-0
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description, SKILL.md usage examples, and the 16 JSON workflow definitions all describe ERPNext/Frappe document workflows (CRM, sales, purchase, inventory, projects, payments, utilities). The required artifacts (JSON definitions referencing tools like create_document, get_doctype_meta, get_document, etc.) are appropriate for an ERPNext workflow skill.
Instruction Scope
SKILL.md is instruction-only and references included JSON definitions; it does not ask the agent to read unrelated system files or environment variables. However, some definitions (generic_task, bulk_operation, complete_sales_workflow) expose broad capabilities: dynamic doctype discovery, bulk create/update/delete, and run_doc_method/run_custom_method. Those are coherent for an ERP automation utility but are powerful and should be permitted only when the executing agent identity has appropriate ERPNext permissions and confirmations (guardrails are present in the JSON, e.g., require_confirmation_for_delete, validate_permissions).
Install Mechanism
Instruction-only skill with no install spec and no code files to execute on install; nothing is downloaded or written to disk by the skill bundle itself.
Credentials
The skill declares no required environment variables, credentials, or config paths. The workflows call platform tools (create_document, get_document, etc.) — this is expected; the skill itself does not request unrelated credentials. Note: those platform tools will use whichever ERPNext credentials the agent already has, so credential scope should be reviewed before granting the agent ERP access.
Persistence & Privilege
always is false, no install steps, and the skill does not request persistent system-wide privileges or attempt to modify other skills. Autonomous invocation is allowed by platform default but is not set by the skill to an elevated value.
Assessment
This skill is internally coherent for ERPNext automation and only contains JSON workflow definitions and usage instructions. Before installing, confirm: (1) the agent identity that will run these workflows has appropriately limited ERPNext permissions (especially for bulk delete/update and run_custom_method actions); (2) guardrails (confirmation for deletes, max batch sizes, permission validation) are enforced by the host platform at runtime; (3) test in a staging environment first. Also note the skill's source/homepage is unknown — that is a provenance risk (not an internal inconsistency): if you want to trust it long-term, ask the publisher for origin and maintenance information.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.0
Download zip
latestvk97dvz1mpckfxc6j2mx67wqy8d81b61s

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

Business Claw Skills

High-level business workflows that combine multiple MCP tools into reusable, executable skills for ERPNext.

Overview

Skills are pre-defined workflows stored as JSON files in definitions/. Each skill defines:

  • Triggers: Natural language patterns that activate the skill
  • Tools: MCP tools to execute in sequence
  • Input Schema: Required and optional parameters
  • Workflow Steps: Ordered execution plan with variable substitution
  • Guardrails: Validation rules for safe execution
  • Output Template: Formatted response message

Available Skills

CRM Skills

SkillDescriptionCategory
create_customerCreate a new customer with contact and addresscrm
create_leadRegister a new leadcrm
create_supplierAdd a new suppliercrm

Sales Skills

SkillDescriptionCategory
create_sales_orderCreate a sales ordersales
create_quotationCreate a quotationsales
create_invoiceGenerate sales invoicesales
complete_sales_workflowFull Quotation → SO → Invoice → Paymentsales

Purchase Skills

SkillDescriptionCategory
create_purchase_orderCreate a purchase orderpurchase

Inventory Skills

SkillDescriptionCategory
create_itemCreate new item in inventoryinventory
stock_entryRecord stock movementsinventory

Project Skills

SkillDescriptionCategory
create_projectCreate a new projectproject

Financial Skills

SkillDescriptionCategory
process_paymentRecord payment entrypayments

Utility Skills

SkillDescriptionCategory
search_recordsSearch across DocTypesutility
bulk_operationBulk create/update/deleteutility
generic_taskFlexible multi-step workflowutility

Usage

Loading Skills

from bc_skills import get_available_skills, load_skill

# List all available skills
skills = get_available_skills()
print(skills)  # ['create_customer', 'create_sales_order', ...]

# Load a specific skill
skill = load_skill("create_customer")

Executing Skills

from bc_skills.loader import execute_skill

result = execute_skill(
    name="create_customer",
    context={
        "customer_name": "ACME Corp",
        "customer_type": "Company",
        "customer_group": "Commercial",
        "email": "contact@acme.com"
    },
    user="Administrator"
)

print(result)

Trigger Examples

Skills respond to natural language triggers:

Trigger PhraseSkill
"create customer"create_customer
"add customer"create_customer
"new customer"create_customer
"complete sales workflow"complete_sales_workflow
"full sales process"complete_sales_workflow
"process order to payment"complete_sales_workflow
"create sales order"create_sales_order
"generate invoice"create_invoice

Skill Definition Schema

{
  "name": "skill_name",
  "version": "1.0.0",
  "description": "What the skill does",
  "author": "Business Claw Team",
  "category": "crm|sales|purchase|inventory|project|payments|utility",
  
  "triggers": [
    "trigger phrase 1",
    "trigger phrase 2"
  ],
  
  "tools": [
    {
      "name": "tool_name",
      "description": "What it does",
      "required": true
    }
  ],
  
  "input_schema": {
    "type": "object",
    "properties": {
      "param_name": {
        "type": "string",
        "description": "Parameter description",
        "enum": ["option1", "option2"]
      }
    },
    "required": ["required_param"]
  },
  
  "workflow": {
    "steps": [
      {
        "step": "step_name",
        "tool": "tool_to_call",
        "arguments": {
          "doctype": "DocType",
          "data": {
            "field": "${variable}"
          }
        }
      }
    ]
  },
  
  "guardrails": {
    "rule_name": true
  },
  
  "output_template": "Formatted output {{variable}}"
}

Variable Substitution

Workflow steps support ${variable} substitution from execution context:

{
  "step": "create_order",
  "tool": "create_document",
  "arguments": {
    "doctype": "Sales Order",
    "data": {
      "customer": "${customer_id}",
      "items": "${items}"
    }
  }
}

Creating Custom Skills

  1. Create a JSON file in definitions/
  2. Define triggers, tools, input schema, and workflow
  3. Use the SkillLoader to load and execute

Example custom skill structure:

{
  "name": "my_custom_skill",
  "version": "1.0.0",
  "description": "My custom workflow",
  "category": "utility",
  "triggers": ["my trigger"],
  "tools": [
    {"name": "get_doctype_meta", "required": true},
    {"name": "create_document", "required": true}
  ],
  "input_schema": {
    "type": "object",
    "properties": {
      "param1": {"type": "string"}
    },
    "required": ["param1"]
  },
  "workflow": {
    "steps": [
      {
        "step": "step1",
        "tool": "get_doctype_meta",
        "arguments": {"doctype": "Item"}
      }
    ]
  },
  "output_template": "Result: {{result}}"
}

Architecture

  • loader.py - SkillLoader class manages skill loading and execution
  • definitions/ - JSON files containing skill definitions
  • Skills use the ToolRouter to execute MCP tools in sequence
  • Guardrails provide validation before skill execution

Requirements

  • Frappe/ERPNext environment
  • bc_mcp module for tool routing
  • JSON or YAML skill definitions

License

MIT

Files

16 total
Select a file
Select a file to preview.

Comments

Loading comments…