Frappecli
v0.1.1CLI for Frappe Framework / ERPNext instances. Use when user asks about "Frappe", "ERPNext", "doctypes", "Frappe API", or needs to manage documents, files, reports, or call RPC methods on a Frappe site.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (Frappe CLI for ERPNext) matches the SKILL.md: it documents commands for doctype, document CRUD, files, reports, and RPC calls. No unrelated services, binaries, or credentials are requested by the skill bundle itself.
Instruction Scope
The SKILL.md instructs the user/agent to install and run a CLI that interacts with remote Frappe sites and to create a config file at ~/.config/frappecli/config.yaml containing api_key/api_secret. This is expected for a remote-API CLI, but it does mean the agent will (if invoked) read/write a config file with secrets and will make network calls to the configured sites. The SKILL.md does not direct the agent to read other system files or unrelated environment variables.
Install Mechanism
The skill bundle is instruction-only (no install spec) so nothing in the skill will be written to disk by default. The documentation suggests installing via a third-party Homebrew tap or cloning a GitHub repo and using pip; both are common but should be verified by the user. One command in the instructions ('uv sync') is unusual and may refer to a specific tool — verify what 'uv' is before running.
Credentials
The bundle declares no environment variables or credentials. The SKILL.md expects API keys and secrets placed in the CLI config file for the Frappe sites, which is proportional to the described functionality and typical for this kind of tool.
Persistence & Privilege
always:false and default autonomy settings are used (agent may invoke the skill when relevant). This is normal for skills that interact with external services. There is no request to modify other skills or system-wide settings.
Assessment
This skill appears internally consistent, but take basic precautions before installing or using it: 1) Verify the Homebrew tap and GitHub repository (pasogott/frappecli) are the authentic sources you expect. 2) Inspect the repository code (and the Homebrew formula) before installing to confirm there are no surprises. 3) When creating ~/.config/frappecli/config.yaml, use least-privilege API keys limited to the actions needed and set tight file permissions (e.g., 600) so secrets aren't world-readable. 4) Be cautious about running unfamiliar commands (the SKILL.md includes an unusual 'uv sync' step—clarify what that does). 5) Remember the CLI issues network requests and can run RPCs on your Frappe sites—avoid giving it keys for highly privileged accounts until you've audited the code and source. If you want additional confidence, ask the publisher for a signed release or a link to an official project homepage before installing.Like a lobster shell, security has layers — review code before you run it.
latest
frappecli
CLI for managing Frappe Framework instances via REST API.
Installation
brew tap pasogott/tap
brew install frappecli
Or from source:
git clone https://github.com/pasogott/frappecli.git
cd frappecli && uv sync && uv pip install -e .
Configuration
Create ~/.config/frappecli/config.yaml:
sites:
production:
url: https://erp.company.com
api_key: your_api_key
api_secret: your_api_secret
staging:
url: https://staging.company.com
api_key: your_staging_key
api_secret: your_staging_secret
default_site: production
Commands
Site Management
frappecli site doctypes # List all doctypes
frappecli site doctypes --module "Core" # Filter by module
frappecli site info "User" # Get doctype details
Document CRUD
# List documents
frappecli doc list Customer
frappecli doc list Customer --filters '{"status":"Active"}' --limit 10
# Get single document
frappecli doc get Customer CUST-001
frappecli doc get Customer CUST-001 --fields name,customer_name,status
# Create document
frappecli doc create Customer --data '{"customer_name":"Acme","customer_type":"Company"}'
# Update document
frappecli doc update Customer CUST-001 --data '{"status":"Inactive"}'
# Delete document
frappecli doc delete Customer CUST-001
File Management
# Upload file (private by default)
frappecli file upload invoice.pdf --doctype "Sales Invoice" --docname "INV-001"
# Upload public file
frappecli file upload logo.png --public
# Download file
frappecli file download /private/files/invoice.pdf -o ./downloads/
# List files for document
frappecli file list --doctype "Sales Invoice" --docname "INV-001"
Reports
# Run report (JSON output)
frappecli report run "General Ledger" --filters '{"company":"My Company"}'
# Export to CSV
frappecli report run "Accounts Receivable" --format csv -o report.csv
RPC Methods
# Call custom method
frappecli rpc frappe.ping
# With arguments
frappecli rpc myapp.api.process_data --args '{"doc_id":"DOC-001"}'
Multi-Site
# Use specific site
frappecli --site staging doc list Customer
# Switch default site
frappecli config set default_site staging
Output Formats
frappecli doc list Customer --format table # Pretty table (default)
frappecli doc list Customer --format json # JSON
frappecli doc list Customer --format csv # CSV
Examples
Bulk Operations
# Export all active customers
frappecli doc list Customer --filters '{"status":"Active"}' --format csv > customers.csv
# Get document with child tables
frappecli doc get "Sales Invoice" INV-001 --fields '*'
Integration with jq
# Get customer names only
frappecli doc list Customer --format json | jq -r '.[].customer_name'
# Count by status
frappecli doc list Customer --format json | jq 'group_by(.status) | map({status: .[0].status, count: length})'
Links
- Repository: https://github.com/pasogott/frappecli
- Homebrew:
brew install pasogott/tap/frappecli
Comments
Loading comments...
