Not in the top 1,000 by GitHub stars
frappe/skills
Agent skills for Frappe App development
History
Review weekly changes to SKILL.md before updating. Dates mark the weeks in which we observed each version; checks apply to the recorded commits.
View weekly changes
skills/code-style/SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Instructions only → After Instructions only
5dc2f984081f → 5dc2f984081f
Diff text is unavailable under the recorded licenses. Line counts and the GitHub link remain available.
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Instructions only
First observation → 5dc2f984081f
No earlier version was observed for comparison.
skills/deep-app-audit/SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
5dc2f984081f → 5dc2f984081f
Diff text is unavailable under the recorded licenses. Line counts and the GitHub link remain available.
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Network or broad shell
First observation → 5dc2f984081f
No earlier version was observed for comparison.
skills/draft-security-advisory/SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Instructions only → After Instructions only
5dc2f984081f → 5dc2f984081f
Diff text is unavailable under the recorded licenses. Line counts and the GitHub link remain available.
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Instructions only
First observation → 5dc2f984081f
No earlier version was observed for comparison.
skills/fix-issue/SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Instructions only → After Instructions only
5dc2f984081f → 5dc2f984081f
Diff text is unavailable under the recorded licenses. Line counts and the GitHub link remain available.
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Instructions only
First observation → 5dc2f984081f
No earlier version was observed for comparison.
skills/frappe-app-dev/SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
5dc2f984081f → 5dc2f984081f
Diff text is unavailable under the recorded licenses. Line counts and the GitHub link remain available.
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Network or broad shell
First observation → 5dc2f984081f
No earlier version was observed for comparison.
skills/frappe-code-review/SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Instructions only → After Instructions only
5dc2f984081f → 5dc2f984081f
Diff text is unavailable under the recorded licenses. Line counts and the GitHub link remain available.
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Instructions only
First observation → 5dc2f984081f
No earlier version was observed for comparison.
skills/resolve-backport-conflicts/SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Instructions only → After Instructions only
5dc2f984081f → 5dc2f984081f
Diff text is unavailable under the recorded licenses. Line counts and the GitHub link remain available.
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Instructions only
First observation → 5dc2f984081f
No earlier version was observed for comparison.
skills/ship-it/SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
5dc2f984081f → 5dc2f984081f
Diff text is unavailable under the recorded licenses. Line counts and the GitHub link remain available.
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Network or broad shell
First observation → 5dc2f984081f
No earlier version was observed for comparison.
skills/technical-writing/SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Instructions only → After Instructions only
5dc2f984081f → 5dc2f984081f
Diff text is unavailable under the recorded licenses. Line counts and the GitHub link remain available.
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Instructions only
First observation → 5dc2f984081f
No earlier version was observed for comparison.
skills/ui-design/SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Instructions only → After Instructions only
5dc2f984081f → 5dc2f984081f
Diff text is unavailable under the recorded licenses. Line counts and the GitHub link remain available.
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Instructions only
First observation → 5dc2f984081f
No earlier version was observed for comparison.
Heat
4.3- Star growth, last 7 daysNot available
- Star growth, last 24 hoursNot available
- Rank movement, last 7 daysNot available
- Commits, last 30 daysNot available
- Accounts asking about it through MCP, last 7 daysNot available
- Hot votes this weekNot available
Heat never changes the order by stars, and sponsorship never touches it. How heat works
Stars over time
30-day change not yet available: not enough history.
Individual skills in this repository
- code-style
skills/code-style - deep-app-audit
skills/deep-app-audit - draft-security-advisory
skills/draft-security-advisory - fix-issue
skills/fix-issue - frappe-app-dev
skills/frappe-app-dev - frappe-code-review
skills/frappe-code-review - resolve-backport-conflicts
skills/resolve-backport-conflicts - ship-it
skills/ship-it - technical-writing
skills/technical-writing - ui-design
skills/ui-design
How it works
code-style
When your agent uses it
Code style rules for readable, maintainable implementation. Load this skill always when writing or editing code, and whenever the user asks about code style, refactoring shape, function/file size, object-oriented structure, helper ordering, or comments. For Frappe-specific work, prefer frappe-app-dev.
What it loads into context
Frontmatter
66 tokensAlways available to the agent
SKILL.md
175 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
Files
SKILL.mdcore884 bytes
No excerpt is shown for this license. Read the source on GitHub.
View the complete source on GitHubdeep-app-audit
When your agent uses it
Deep audit of a Frappe app for security, correctness, and customization defects. Runs every security scope and every quality rule in a separate agent, verifies each candidate in a fresh context, and compiles one report. User-invoked only - run /deep-app-audit [app path] [options].
What it loads into context
Frontmatter
79 tokensAlways available to the agent
SKILL.md
5,706 tokensWhen the skill is activated
Reference documents
114,890 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- How a run works
- 1. Read the arguments
- 2. Confirm the target
- 3. Prepare the run
- 4. Start the test site
- 5. Run the tasks
- 6. Tell the user
- Prompts
- Warning
Scripts executed separately
scripts/build_inventory.pyscripts/run_audit.py
Files
SKILL.mdcore21,733 bytesSKILL.mdcore21,733 bytesSKILL.mdcore21,733 bytesSKILL.mdcore21,733 bytesSKILL.mdcore21,733 bytesagents.example.jsonasset1,059 bytesprompts/check.mddoc1,514 bytesprompts/context.mddoc3,895 bytesprompts/report.mddoc4,349 bytesprompts/scan.mddoc1,714 bytesprompts/verify.mddoc1,461 bytesquality/A-customization/A01-no-monkey-patching.mddoc2,117 bytesquality/A-customization/A02-override-class-calls-super.mddoc2,299 bytesquality/A-customization/A03-extend-instead-of-override.mddoc1,959 bytesquality/A-customization/A04-regional-override-first.mddoc1,501 bytesquality/A-customization/A05-override-whitelisted-method-contract.mddoc1,936 bytesquality/A-customization/A06-hook-the-transaction-not-the-ledger.mddoc2,256 bytesquality/A-customization/A07-reuse-the-existing-doctype.mddoc2,352 bytesquality/A-customization/A08-custom-fields-in-code.mddoc2,187 bytesquality/A-customization/A09-fixtures-overwrite-the-site.mddoc1,913 bytesquality/A-customization/A10-remove-customizations-on-uninstall.mddoc1,911 bytesquality/A-customization/A11-declare-required-apps.mddoc2,251 bytesquality/A-customization/A12-declare-versions-and-branches.mddoc1,811 bytesquality/A-customization/A13-clean-bench-install.mddoc1,760 bytesquality/A-customization/A14-dotted-paths-must-resolve.mddoc2,364 bytesquality/A-customization/A15-scheduler-method-path-is-an-api.mddoc2,204 bytesquality/A-customization/A16-prefix-custom-fieldnames.mddoc2,092 bytesquality/A-customization/A17-keep-standard-field-constraints.mddoc2,286 bytesquality/A-customization/A18-check-every-writer.mddoc2,174 bytesquality/A-customization/A19-bound-the-custom-field-count.mddoc2,108 bytesquality/A-customization/A20-server-side-rules-not-in-client-scripts.mddoc2,478 bytesquality/A-customization/A22-app-logic-not-in-server-scripts.mddoc2,098 bytesquality/A-customization/A24-hooks-py-is-static-data.mddoc2,315 bytesquality/A-customization/A25-handler-signature-matches-call-site.mddoc4,200 bytesquality/A-customization/A26-hook-return-value-contract.mddoc2,310 bytesquality/A-customization/A27-last-wins-hooks-must-yield.mddoc2,253 bytesquality/A-customization/A28-permission-hooks-only-narrow.mddoc2,414 bytesquality/A-customization/A29-virtual-doctype-contract.mddoc2,569 bytesquality/A-customization/A30-no-code-for-a-custom-doctype.mddoc1,829 bytesquality/A-customization/A31-default-print-format-property-setter.mddoc1,945 bytesquality/A-customization/A32-templates-read-data.mddoc2,179 bytesquality/A-customization/A33-protect-setup-from-company-deletion.mddoc1,626 bytesquality/A-customization/A34-support-accounting-dimensions.mddoc2,145 bytesquality/A-customization/A35-ignore-links-on-delete-is-for-logs.mddoc1,697 bytesquality/A-customization/A38-frappe-call-targets-resolve.mddoc2,109 bytesquality/A-customization/A39-install-hooks-return-nothing.mddoc1,730 bytesquality/A-customization/A40-ship-desk-artefacts-as-files.mddoc2,013 bytesquality/A-customization/A41-no-direct-ledger-writes.mddoc2,729 bytesquality/B-correctness/B01-no-transaction-control-in-lifecycle.mddoc4,000 bytesquality/B-correctness/B02-own-the-rollback-you-catch.mddoc2,327 bytesquality/B-correctness/B03-ddl-ends-the-transaction.mddoc2,184 bytesquality/B-correctness/B04-enqueue-after-commit.mddoc1,826 bytesquality/B-correctness/B05-check-then-insert-is-a-race.mddoc2,079 bytesquality/B-correctness/B06-lock-the-rows-you-change.mddoc2,182 bytesquality/B-correctness/B07-fixed-lock-order.mddoc1,703 bytesquality/B-correctness/B08-idempotent-endpoint-and-job.mddoc2,297 bytesquality/B-correctness/B09-computed-field-is-a-function-of-input.mddoc1,898 bytesquality/B-correctness/B10-rebuild-a-child-table.mddoc1,608 bytesquality/B-correctness/B11-patch-must-be-rerunnable.mddoc2,657 bytesquality/B-correctness/B12-reload-doctype-before-a-patch-reads-it.mddoc1,929 bytesquality/B-correctness/B13-schema-change-needs-a-data-patch.mddoc2,025 bytesquality/B-correctness/B16-treat-every-read-as-possibly-empty.mddoc2,100 bytesquality/B-correctness/B17-coerce-at-the-boundary.mddoc2,402 bytesquality/B-correctness/B18-compare-money-at-field-precision.mddoc1,940 bytesquality/B-correctness/B19-compare-dates-as-dates.mddoc2,058 bytesquality/B-correctness/B20-single-doctype-value-api.mddoc2,064 bytesquality/B-correctness/B21-destructive-call-needs-a-filter.mddoc1,824 bytesquality/B-correctness/B25-one-owner-writes-status.mddoc2,029 bytesquality/B-correctness/B26-update-dependents-on-lifecycle-change.mddoc2,159 bytesquality/B-correctness/B27-change-a-child-row-through-its-parent.mddoc1,701 bytesquality/B-correctness/B28-orm-bypass-runs-no-validation.mddoc1,979 bytesquality/B-correctness/B29-persist-a-change-made-after-the-write-step.mddoc1,814 bytesquality/B-correctness/B31-no-request-state-in-lifecycle-code.mddoc1,984 bytesquality/B-correctness/B32-no-dependence-on-handler-order.mddoc2,173 bytesquality/B-correctness/B33-use-a-lifecycle-name-the-framework-calls.mddoc2,162 bytesquality/B-correctness/B34-validate-an-update-after-submit.mddoc2,129 bytesquality/B-correctness/B35-validate-in-every-path.mddoc2,249 bytesquality/B-correctness/B36-filter-submittable-doctypes-by-docstatus.mddoc1,974 bytesquality/B-correctness/B37-ordered-queries-need-a-tie-breaker.mddoc1,994 bytesquality/B-correctness/B40-optional-step-must-not-fail-the-flow.mddoc2,397 bytesquality/B-correctness/B42-templates-render-with-missing-data.mddoc1,891 bytesquality/B-correctness/B43-clear-the-document-cache-after-a-raw-write.mddoc2,096 bytesquality/B-correctness/B44-no-site-state-at-module-scope.mddoc2,521 bytesquality/B-correctness/B45-refresh-the-field-after-code-changes-it.mddoc2,148 bytesquality/_conventions.mddoc9,635 bytesquality/checks/K01-override-duplicates-core-method.mddoc5,364 bytesquality/checks/K02-framework-surface-breakage.mddoc17,060 bytesquality/mechanisms/M01-hooks-merge.mddoc2,533 bytesquality/mechanisms/M02-install-and-uninstall-hooks.mddoc3,418 bytesquality/mechanisms/M03-enable-and-disable-hooks.mddoc2,440 bytesquality/mechanisms/M04-migrate-hooks-and-patches.mddoc3,176 bytesquality/mechanisms/M05-build-hooks.mddoc1,598 bytesquality/mechanisms/M06-before-tests.mddoc1,675 bytesquality/mechanisms/M07-request-hooks.mddoc2,141 bytesquality/mechanisms/M08-job-hooks.mddoc2,182 bytesquality/mechanisms/M09-session-hooks.mddoc2,010 bytesquality/mechanisms/M10-controller-class.mddoc2,344 bytesquality/mechanisms/M11-document-lifecycle.mddoc4,617 bytesquality/mechanisms/M12-doc-events.mddoc3,047 bytesquality/mechanisms/M13-override-doctype-class.mddoc2,710 bytesquality/mechanisms/M14-extend-doctype-class.mddoc2,349 bytesquality/mechanisms/M15-virtual-doctype.mddoc3,092 bytesquality/mechanisms/M16-custom-doctype.mddoc2,331 bytesquality/mechanisms/M17-override-whitelisted-methods.mddoc2,794 bytesquality/mechanisms/M18-custom-field.mddoc3,521 bytesquality/mechanisms/M19-property-setter.mddoc2,851 bytesquality/mechanisms/M20-customize-form.mddoc2,791 bytesquality/mechanisms/M21-custom-folder-sync.mddoc3,067 bytesquality/mechanisms/M22-fixtures.mddoc2,431 bytesquality/mechanisms/M23-importable-doctypes.mddoc1,421 bytesquality/mechanisms/M24-client-script.mddoc2,248 bytesquality/mechanisms/M25-server-script.mddoc2,543 bytesquality/mechanisms/M26-doctype-layout.mddoc1,586 bytesquality/mechanisms/M27-naming.mddoc2,248 bytesquality/mechanisms/M28-workflow-methods.mddoc2,468 bytesquality/mechanisms/M29-data-driven-event-consumers.mddoc2,281 bytesquality/mechanisms/M30-link-check-exemptions.mddoc1,986 bytesquality/mechanisms/M31-dashboard-data.mddoc1,669 bytesquality/mechanisms/M32-timeline.mddoc1,804 bytesquality/mechanisms/M33-link-search.mddoc2,385 bytesquality/mechanisms/M34-has-permission-hook.mddoc2,262 bytesquality/mechanisms/M35-permission-query-conditions.mddoc2,511 bytesquality/mechanisms/M36-website-permission.mddoc2,156 bytesquality/mechanisms/M37-desk-js-files.mddoc2,328 bytesquality/mechanisms/M38-doctype-js-hooks.mddoc2,191 bytesquality/mechanisms/M39-form-event-handlers.mddoc2,441 bytesquality/mechanisms/M40-list-calendar-tree-settings.mddoc2,130 bytesquality/mechanisms/M41-formatters.mddoc1,902 bytesquality/mechanisms/M42-report-code.mddoc2,058 bytesquality/mechanisms/M43-dashboard-chart-source.mddoc1,981 bytesquality/mechanisms/M44-boot-hooks.mddoc2,432 bytesquality/mechanisms/M45-app-identity-and-navigation.mddoc2,382 bytesquality/mechanisms/M46-setup-wizard-hooks.mddoc2,574 bytesquality/mechanisms/M47-jinja.mddoc2,667 bytesquality/mechanisms/M48-print.mddoc2,823 bytesquality/mechanisms/M49-email-and-sms.mddoc2,600 bytesquality/mechanisms/M50-website-routing.mddoc2,977 bytesquality/mechanisms/M51-website-context-and-portal.mddoc3,110 bytesquality/mechanisms/M52-website-controllers.mddoc2,475 bytesquality/mechanisms/M53-assets.mddoc1,778 bytesquality/mechanisms/M54-scheduler.mddoc2,414 bytesquality/mechanisms/M55-cache-hooks.mddoc1,766 bytesquality/mechanisms/M56-file-hooks.mddoc2,115 bytesquality/mechanisms/M57-data-and-logs.mddoc2,708 bytesquality/mechanisms/M58-monkeypatching.mddoc2,184 bytesscripts/build_inventory.pyruns50,862 bytesscripts/run_audit.pyruns25,919 bytessecurity/A-authorization/A01-whitelist-authorization.mddoc2,497 bytessecurity/A-authorization/A02-idor-bola.mddoc1,936 bytessecurity/A-authorization/A03-client-settable-permission-bypass.mddoc1,102 bytessecurity/A-authorization/A04-guest-endpoints-and-rate-limits.mddoc2,382 bytessecurity/A-authorization/A05-role-permission-model.mddoc2,624 bytessecurity/A-authorization/A06-permission-query-and-hooks.mddoc2,233 bytessecurity/A-authorization/A07-child-table-and-linked-fields.mddoc1,455 bytessecurity/A-authorization/A08-privilege-escalation.mddoc1,045 bytessecurity/A-authorization/A09-rest-api-parity.mddoc1,043 bytessecurity/A-authorization/A10-realtime-socketio.mddoc1,072 bytessecurity/A-authorization/A11-share-assign-follow.mddoc1,055 bytessecurity/A-authorization/A12-webform-portal-webview.mddoc1,041 bytessecurity/A-authorization/A13-reports-authorization.mddoc1,143 bytessecurity/A-authorization/A14-doc-method-write-gate.mddoc2,717 bytessecurity/B-injection/B01-sql-injection.mddoc3,998 bytessecurity/B-injection/B02-untyped-orm-parameters.mddoc2,802 bytessecurity/B-injection/B03-query-builder-misuse.mddoc2,210 bytessecurity/B-injection/B04-multistatement-and-file-primitives.mddoc1,035 bytessecurity/B-injection/B05-ssti-jinja-templates.mddoc1,214 bytessecurity/B-injection/B06-jinja-sandbox-and-globals.mddoc1,554 bytessecurity/B-injection/B07-safe-exec-sandbox.mddoc1,462 bytessecurity/B-injection/B08-command-shell-injection.mddoc985 bytessecurity/B-injection/B09-dynamic-dispatch.mddoc1,145 bytessecurity/B-injection/B10-header-log-ldap-redis-deserialization.mddoc1,683 bytessecurity/C-xss-client/C01-stored-xss-document-fields.mddoc1,127 bytessecurity/C-xss-client/C02-unsafe-html-sinks.mddoc2,176 bytessecurity/C-xss-client/C03-sanitizer-bypasses.mddoc1,054 bytessecurity/C-xss-client/C04-iframes-svg-served-html.mddoc939 bytessecurity/C-xss-client/C05-csrf.mddoc1,002 bytessecurity/D-auth-identity/D01-session-handling.mddoc1,085 bytessecurity/D-auth-identity/D02-password-reset.mddoc1,106 bytessecurity/D-auth-identity/D03-two-factor.mddoc1,142 bytessecurity/D-auth-identity/D04-oauth-sso.mddoc1,128 bytessecurity/D-auth-identity/D05-user-enumeration-oracles.mddoc1,101 bytessecurity/D-auth-identity/D06-hmac-signed-urls.mddoc1,104 bytessecurity/D-auth-identity/D07-api-keys-tokens.mddoc963 bytessecurity/D-auth-identity/D08-impersonation-set-user.mddoc1,063 bytessecurity/E-files-paths/E01-path-traversal.mddoc2,325 bytessecurity/E-files-paths/E02-upload-validation.mddoc1,067 bytessecurity/E-files-paths/E03-file-privacy-and-permissions.mddoc1,123 bytessecurity/E-files-paths/E04-static-file-serving.mddoc1,070 bytessecurity/F-ssrf-outbound/F01-ssrf.mddoc2,158 bytessecurity/F-ssrf-outbound/F02-header-trust.mddoc1,095 bytessecurity/F-ssrf-outbound/F03-open-redirect.mddoc986 bytessecurity/G-crypto-secrets/G01-secret-storage.mddoc1,406 bytessecurity/G-crypto-secrets/G02-secrets-in-logs-and-responses.mddoc1,063 bytessecurity/G-crypto-secrets/G03-weak-randomness.mddoc851 bytessecurity/G-crypto-secrets/G04-crypto-primitives.mddoc868 bytessecurity/H-business-logic/H01-mass-assignment.mddoc1,137 bytessecurity/H-business-logic/H02-workflow-docstatus-bypass.mddoc1,111 bytessecurity/H-business-logic/H03-financial-validation.mddoc1,074 bytessecurity/H-business-logic/H04-race-conditions.mddoc991 bytessecurity/H-business-logic/H05-tenant-company-scoping.mddoc1,021 bytessecurity/I-info-disclosure/I01-over-fetching-endpoints.mddoc1,975 bytessecurity/I-info-disclosure/I02-metadata-leaks.mddoc2,022 bytessecurity/I-info-disclosure/I03-search-leaks.mddoc990 bytessecurity/I-info-disclosure/I04-pii-exposure.mddoc1,025 bytessecurity/J-email-messaging/J01-recipient-control-and-spoofing.mddoc1,000 bytessecurity/J-email-messaging/J02-inbound-email-trust.mddoc1,129 bytessecurity/J-email-messaging/J03-communication-permission.mddoc1,038 bytessecurity/K-dos-abuse/K01-resource-exhaustion.mddoc1,373 bytessecurity/K-dos-abuse/K02-job-and-scheduler-abuse.mddoc921 bytessecurity/L-supply-chain/L01-python-dependencies.mddoc984 bytessecurity/L-supply-chain/L02-js-dependencies.mddoc1,312 bytessecurity/_conventions.mddoc15,782 bytessecurity/_framework-guards.mddoc15,451 bytessecurity/checks/P01-endpoint-hardening-coverage.mddoc1,849 bytessecurity/checks/P02-invariant-diffs.mddoc3,228 bytessecurity/checks/P03-security-headers.mddoc1,193 bytessecurity/checks/P04-dependency-pinning-integrity.mddoc1,047 bytessecurity/checks/P05-ci-cd-and-repo-hygiene.mddoc1,325 bytes
No excerpt is shown for this license. Read the source on GitHub.
View the complete source on GitHubdraft-security-advisory
When your agent uses it
Turn a vulnerability report into a publication-ready GitHub Security Advisory.
What it loads into context
Frontmatter
30 tokensAlways available to the agent
SKILL.md
1,354 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Class, not instance
- Title
- Text fields
- Structured fields
- Derivation rules
- Final check
Files
SKILL.mdcore6,137 bytes
No excerpt is shown for this license. Read the source on GitHub.
View the complete source on GitHubfix-issue
When your agent uses it
Fix a bug reported in a GitHub issue or a markdown file, without letting the report's noise and guesses into the main context. Takes an issue number, an issue URL, or a file path as an argument. Use when asked to fix, investigate, or reproduce a reported bug.
What it loads into context
Frontmatter
73 tokensAlways available to the agent
SKILL.md
973 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- 1. Extract the facts
- 2. Reproduce before you fix
- 3. Find the cause yourself
- 4. Fix and verify
- 5. Review in a separate agent
- 6. Report
Files
SKILL.mdcore3,970 bytes
No excerpt is shown for this license. Read the source on GitHub.
View the complete source on GitHubfrappe-app-dev
When your agent uses it
Builds full-stack Frappe Framework applications end-to-end. Use this skill any time the user mentions: creating or modifying a DocType, writing a controller or lifecycle hook, adding a whitelisted API, setting up a new Frappe app or bench site, building a desk form or list view, creating portal pages, writing background jobs or scheduled tasks, managing permissions or roles, writing Frappe tests, or working with frappe.db / frappe.qb. Also applies when the user says things like "how do I hook into save", "add a field to a DocType", "create a REST endpoint in Frappe", "run bench migrate", or "install an app on a site" — even if they don't explicitly say "Frappe".
What it loads into context
Frontmatter
180 tokensAlways available to the agent
SKILL.md
815 tokensWhen the skill is activated
Reference documents
12,006 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Global Rules
- Flow Selection
- Feature References
Files
SKILL.mdcore3,777 bytesreferences/api.mddoc5,338 bytesreferences/background-jobs.mddoc2,524 bytesreferences/bench-operations.mddoc1,807 bytesreferences/caching.mddoc1,266 bytesreferences/controllers.mddoc3,604 bytesreferences/database.mddoc6,705 bytesreferences/doctypes.mddoc3,296 bytesreferences/existing-app.mddoc1,726 bytesreferences/frontend-desk.mddoc2,033 bytesreferences/frontend-portal.mddoc839 bytesreferences/frontend-vue.mddoc3,002 bytesreferences/frontend.mddoc632 bytesreferences/hooks.mddoc3,369 bytesreferences/new-app.mddoc1,793 bytesreferences/permissions.mddoc2,978 bytesreferences/realtime.mddoc2,588 bytesreferences/site-management.mddoc1,335 bytesreferences/testing.mddoc2,654 bytes
No excerpt is shown for this license. Read the source on GitHub.
View the complete source on GitHubfrappe-code-review
When your agent uses it
Review code for any Frappe application — a checklist distilled from years of engineering practice on correctness, security, performance, concurrency, readability, API design, and testing. Use this when reviewing a diff, a PR, or a piece of code for quality and security, or when you want a reviewer's checklist grounded in hard-won Frappe/ERPNext lessons.
What it loads into context
Frontmatter
93 tokensAlways available to the agent
SKILL.md
3,649 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- 1. Correctness & stability (highest consequence)
- 2. Security
- 3. Performance is correctness
- 4. Concurrency
- 5. Readability & maintainability
- 6. API design & backward compatibility
- 7. Testing
- 8. Error messages, logging & observability
Files
SKILL.mdcore15,328 bytes
No excerpt is shown for this license. Read the source on GitHub.
View the complete source on GitHubresolve-backport-conflicts
When your agent uses it
Resolve merge conflicts in a Mergify backport pull request. When a cherry-pick fails, Mergify commits the conflict markers as they are. This skill takes a pull request link or number as an argument.
What it loads into context
Frontmatter
61 tokensAlways available to the agent
SKILL.md
1,094 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- How Mergify leaves the branch
- Steps
Files
SKILL.mdcore4,417 bytesSKILL.mdcore4,417 bytesSKILL.mdcore4,417 bytesSKILL.mdcore4,417 bytesSKILL.mdcore4,417 bytesSKILL.mdcore4,417 bytesSKILL.mdcore4,417 bytesSKILL.mdcore4,417 bytes
No excerpt is shown for this license. Read the source on GitHub.
View the complete source on GitHubship-it
When your agent uses it
Take finished work to a merge-ready PR in one pass - intent, review, live test, docs, lint, PR, and CI. User-invoked only - run /ship-it [wip|prod] ["intent"], or /ship-it on a branch with an open PR to resume or babysit it.
What it loads into context
Frontmatter
79 tokensAlways available to the agent
SKILL.md
2,201 tokensWhen the skill is activated
Reference documents
7,273 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Tier
- Pipeline
- Resume
- Where it runs
- Subagents
- Findings and the user
- Inline steps
Scripts executed separately
scripts/watch-pr.sh
Files
SKILL.mdcore9,439 bytesreview/ask.mddoc2,938 bytesreview/correctness.mddoc2,616 bytesreview/taste.mddoc3,912 bytesreview/verdict.mddoc4,163 bytesscripts/watch-pr.shruns5,709 bytessteps/ci.mddoc5,683 bytessteps/intent.mddoc2,017 bytessteps/pr.mddoc4,508 bytessteps/review.mddoc2,331 bytessteps/test.mddoc2,303 bytes
No excerpt is shown for this license. Read the source on GitHub.
View the complete source on GitHubtechnical-writing
When your agent uses it
Write prose in "Simplified Technical English". This applies to documentation, READMEs, commits, pull request, plans and release notes. It does not apply to code, identifiers, marketing copy, essays, or anything that needs a voice.
What it loads into context
Frontmatter
57 tokensAlways available to the agent
SKILL.md
1,047 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Rules
Files
SKILL.mdcore4,411 bytes
No excerpt is shown for this license. Read the source on GitHub.
View the complete source on GitHubui-design
When your agent uses it
General UI/UX judgment for layout, polish, visual hierarchy, spacing, typography, color, and accessibility. Use when no product-specific or Frappe-specific design system skill applies.
What it loads into context
Frontmatter
44 tokensAlways available to the agent
SKILL.md
778 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Design principles
- Tweak panel
- Typography
- Color
- Layout mechanics
- Review checklist (run at every checkpoint)
- Content
Files
SKILL.mdcore3,565 bytes
No excerpt is shown for this license. Read the source on GitHub.
View the complete source on GitHubSkills included
- code-style
- deep-app-audit
- draft-security-advisory
- fix-issue
- frappe-app-dev
- frappe-code-review
- resolve-backport-conflicts
- ship-it
- technical-writing
- ui-design
Repository facts
- License
- No license detected
- Created
- Mar 29, 2026
- Last pushed
- Nov 5, 2026
- Forks
- 56
- Open issues
- 6
- Project activity
- Active
Before you install
Network or broad shellAutomated signals, not a guarantee
Checked Nov 6, 2026
Not fully analyzed: some files were too long, unreadable or missing. This never lowers the level.
Show 11 notes
skills/deep-app-audit/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/deep-app-audit/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/deep-app-audit/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/deep-app-audit/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/resolve-backport-conflicts/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/resolve-backport-conflicts/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/resolve-backport-conflicts/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/resolve-backport-conflicts/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/resolve-backport-conflicts/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/resolve-backport-conflicts/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/resolve-backport-conflicts/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzed
- No broad tool permissions
- 1 dangerous shell commandin 1 file: ship-it/scripts/watch-pr.sh:50
- 27 network referencesin 10 files: deep-app-audit/SKILL.md:127 deep-app-audit/scripts/run_audit.py:459 ship-it/SKILL.md:96 and 7 more
- No hidden or obfuscated text
- No instruction overrides
- 3 executable scriptsin 3 files: deep-app-audit/scripts/build_inventory.py:1 deep-app-audit/scripts/run_audit.py:1 ship-it/scripts/watch-pr.sh:1
- 2 references to secretsin 2 files: deep-app-audit/scripts/run_audit.py:417 deep-app-audit/security/C-xss-client/C05-csrf.md:21
- No requests to vote in Hot
Show all 33 signals by file
skills/deep-app-audit/SKILL.md
- Network accessline 127
2. Get the rules. With the `semgrep rules` option, use that clone as it is. Else, when `<run dir>/semgrep-rules` does not exist, clone it: `git clone --depth 1 https://github.com/frappe/semgrep-rules <run dir>/semgrep-rules`. - Network accessline 128
`<run dir>/semgrep-rules` does not exist, clone it: `git clone --depth 1 https://github.com/frappe/semgrep-rules <run dir>/semgrep-rules`. A clone in the run directory keeps the rules of one run fixed, also when the run resumes. - Network accessline 129
`git clone --depth 1 https://github.com/frappe/semgrep-rules <run dir>/semgrep-rules`. - Network accessline 221
production rejects, so a 200 from it proves nothing about production. 8. Prove that the site works: - `curl -sS -o /dev/null -w '%{http_code}' <base url>/api/method/ping` returns 200 - Network accessline 222
8. Prove that the site works: - `curl -sS -o /dev/null -w '%{http_code}' <base url>/api/method/ping` returns 200 - a login as `milkshake-s0-user@example.com` through `/api/method/login` returns 200 and sets - Network accessline 223
- `curl -sS -o /dev/null -w '%{http_code}' <base url>/api/method/ping` returns 200 - Network accessline 235
{ "ready": true, "site": "myapp-audit.localhost", "baseUrl": "http://localhost:8199", - Network accessline 236
"ready": true, "site": "myapp-audit.localhost", "baseUrl": "http://localhost:8199",
skills/deep-app-audit/quality/B-correctness/B40-optional-step-must-not-fail-the-flow.md
skills/deep-app-audit/quality/_conventions.md
- Network accessline 47
- `mechanism`: optional. The id of the mechanism page that the rule is about. - `semgrep`: optional. The rule ids in https://github.com/frappe/semgrep-rules that check the - Network accessline 48
- `semgrep`: optional. The rule ids in https://github.com/frappe/semgrep-rules that check the
skills/deep-app-audit/scripts/build_inventory.py
- Executable scriptline 1
Executable file
skills/deep-app-audit/scripts/run_audit.py
- Executable scriptline 1
#!/usr/bin/env python3 - Access to secretsline 417
[Credential-related source omitted] - Network accessline 459
if not self.site: return True request = urllib.request.Request( - Network accessline 460
return True request = urllib.request.Request( self.site["baseUrl"].rstrip("/") + "/api/method/ping", - Network accessline 461
request = urllib.request.Request( - Network accessline 464
) try: with urllib.request.urlopen(request, timeout=20) as response: - Network accessline 465
try: with urllib.request.urlopen(request, timeout=20) as response: return response.status == 200 - Network accessline 466
with urllib.request.urlopen(request, timeout=20) as response:
skills/deep-app-audit/security/C-xss-client/C05-csrf.md
- Access to secretsline 21
[Credential-related source omitted]
skills/frappe-app-dev/references/database.md
- Network accessline 80
Use instead of `get_all` when you need: joins via linked/child fields, aggregations, OR conditions, subqueries, or record locking. Docs: https://docs.frappe.io/framework/get_query
skills/frappe-app-dev/references/frontend-vue.md
skills/frappe-app-dev/references/realtime.md
- Network accessline 54
const socket = io("http://site.localhost:9000", {
skills/ship-it/SKILL.md
- Network accessline 96
- Compare `origin/<branch>` with the recorded sha. When it moved, the remote has work you have not taken in: go back to step 2. - When `origin/<branch>` does not exist or is an ancestor of `HEAD`, use a plain push. Otherwise `HEAD` rewrote - Network accessline 97
- When `origin/<branch>` does not exist or is an ancestor of `HEAD`, use a plain push. Otherwise `HEAD` rewrote pushed commits, in this run or an earlier one: push with `--force-with-lease=<branch>:<recorded sha>`. - When the push is reject - Network accessline 98
- When the push is rejected because the remote changed after the fetch (`non-fast-forward`, `fetch first`, or `stale info`), go back to step 2. Any other rejection (permissions, branch protection, a server-side hook) does not change after a
skills/ship-it/review/correctness.md
- Network accessline 34
Credits: adapted from the review prompt in [no-mistakes](https://github.com/kunchenguid/no-mistakes) (`internal/pipeline/steps/review.go`).
skills/ship-it/review/taste.md
- Network accessline 35
Credits: [pstack](https://github.com/backnotprop/pstack) (Lauren Tan), [mattpocock/skills](https://github.com/mattpocock/skills) `code-review`, [no-mistakes](https://github.com/kunchenguid/no-mistakes) simplification pass, John Ousterhout's
How the signals fit together
Facts from a static read of the files at the pinned commit. They describe what the code does, not why.
Some files could not be read; the facts below still hold.
Signal confidence: 33 facts
- Network access in prose of the SKILL.mddeep-app-audit/SKILL.md:127Low confidence
- Network access in prose of the SKILL.mddeep-app-audit/SKILL.md:128Low confidence
- Network access in prose of the SKILL.mddeep-app-audit/SKILL.md:129Low confidence
- Network access in prose of the SKILL.mddeep-app-audit/SKILL.md:221Low confidence
- Network access in prose of the SKILL.mddeep-app-audit/SKILL.md:222Low confidence
- Network access in prose of the SKILL.mddeep-app-audit/SKILL.md:223Low confidence
- Network access in code of the SKILL.mddeep-app-audit/SKILL.md:235High confidence
- Network access in code of the SKILL.mddeep-app-audit/SKILL.md:236High confidence
- Network access in code of documentationdeep-app-audit/quality/B-correctness/B40-optional-step-must-not-fail-the-flow.md:15Low confidence
- Network access in code of documentationdeep-app-audit/quality/B-correctness/B40-optional-step-must-not-fail-the-flow.md:17Low confidence
- Network access in prose of documentationdeep-app-audit/quality/_conventions.md:47Low confidence
- Network access in prose of documentationdeep-app-audit/quality/_conventions.md:48Low confidence
- Executable script in prose of a file that runsdeep-app-audit/scripts/build_inventory.py:1Low confidence
- Executable script in code of a file that runsdeep-app-audit/scripts/run_audit.py:1High confidence
- Access to secrets in code of a file that runs: a variable, placeholder or call, not a stored valuedeep-app-audit/scripts/run_audit.py:417Low confidence
- Network access in code of a file that runsdeep-app-audit/scripts/run_audit.py:459High confidence
- Network access in code of a file that runsdeep-app-audit/scripts/run_audit.py:460High confidence
- Network access in code of a file that runsdeep-app-audit/scripts/run_audit.py:461High confidence
- Network access in code of a file that runsdeep-app-audit/scripts/run_audit.py:464High confidence
- Network access in code of a file that runsdeep-app-audit/scripts/run_audit.py:465High confidence
- Network access in code of a file that runsdeep-app-audit/scripts/run_audit.py:466High confidence
- Access to secrets in prose of documentationdeep-app-audit/security/C-xss-client/C05-csrf.md:21Low confidence
- Network access in prose of documentationfrappe-app-dev/references/database.md:80Low confidence
- Network access in code of documentationfrappe-app-dev/references/frontend-vue.md:108Low confidence
- Network access in code of documentationfrappe-app-dev/references/frontend-vue.md:110Low confidence
- Network access in code of documentationfrappe-app-dev/references/realtime.md:54Low confidence
- Network access in prose of the SKILL.mdship-it/SKILL.md:96Low confidence
- Network access in prose of the SKILL.mdship-it/SKILL.md:97Low confidence
- Network access in prose of the SKILL.mdship-it/SKILL.md:98Low confidence
- Network access in prose of documentationship-it/review/correctness.md:34Low confidence
- Network access in prose of documentationship-it/review/taste.md:35Low confidence
- Executable script in code of a file that runsship-it/scripts/watch-pr.sh:1High confidence
- Dangerous shell operation in code of a file that runsship-it/scripts/watch-pr.sh:50High confidence
Works with
| Agent | Status | Evidence | Install to |
|---|---|---|---|
| Claude Code | Native | Frontmatter field disable-model-invocation in skills/deep-app-audit/SKILL.md | .claude/skills/<skill-name>/ |
| Codex | Compatible | Standard SKILL.md skills/code-style/SKILL.md | .agents/skills/<skill-name>/ |
| Cursor | Compatible | Standard SKILL.md skills/code-style/SKILL.md | .cursor/skills/<skill-name>/ |
| Gemini CLI | Compatible | Standard SKILL.md skills/code-style/SKILL.md | .gemini/skills/<skill-name>/ |
| GitHub Copilot | Compatible | Standard SKILL.md skills/code-style/SKILL.md | .github/skills/<skill-name>/ |
| OpenCode | Compatible | Standard SKILL.md skills/code-style/SKILL.md | .opencode/skills/<skill-name>/ |
- Native The repository ships a manifest, folder or frontmatter field for this agent.
- Compatible A standard SKILL.md that this agent can read.
- Unknown No evidence either way.
Derived automatically from paths, manifests and frontmatter. Not tested on each agent.