Frappe Skills
A set from the Frappe team: building apps on the framework, code review, security audit and getting a PR ready to merge
- 166 ★ on the repository
- Last commit
Extended access
Why this level
- `/ship-it` commits, pushes the branch and opens a PR, and `bench` changes the site database
- `/deep-app-audit` launches many agent processes and reads the whole app code
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add skills/frappe-skillsDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- `/ship-it` commits, pushes the branch and opens a PR, and `bench` changes the site database
- `/deep-app-audit` launches many agent processes and reads the whole app code
This is third-party code. Review the repository files before installing.
What it does
The main frappe-app-dev skill guides an agent through the full cycle of building a Frappe app: DocTypes and controllers, hooks and whitelisted APIs, the ORM, permissions and roles, background jobs, caching and realtime, tests, the Desk UI, Vue and portals, plus `bench` commands and site management. The frappe-code-review skill gives a review checklist for correctness, security, performance and concurrency. The general code-style, technical-writing and ui-design skills set rules for code, documentation in Simplified Technical English and interfaces. `/draft-security-advisory` (which drafts a GHSA from a vulnerability report), `/deep-app-audit` and `/ship-it` are invoked by hand. `/deep-app-audit <app path>` runs a script that starts a separate agent per security area and per quality rule, verifies findings in a fresh context and writes one report. `/ship-it` takes finished work to a PR: it confirms intent, reviews, tests live, fixes docs and lint, opens the PR and watches CI. A human merges the PR.
Who it is for. Developers of Frappe and ERPNext apps and maintainers who want shared review, audit and PR-preparation rules for an agent.
Good fit when
- You are creating a DocType, a controller or a whitelisted API and want the agent to follow Frappe practice
- The app is growing and the agent has to check it for security and customization defects before a release
- A finished change waits for a PR and you want a run from review through CI watching
- The team received a vulnerability report and is preparing a GitHub Security Advisory
- The agent writes docs and commits in a consistent Simplified Technical English style
Not a fit when
- The project is not on Frappe: most skills are tied to the framework and its `bench` command
- You need a quick audit in minutes: `/deep-app-audit` starts many agent processes and burns tokens
- The repository cannot be handed to an agent subscription whole, and the audit reads the whole app
Example request
Add a Repair Request DocType to the app with a controller that checks stock on save, and show the bench command for the migrationLimitations
- The repository holds ten skills while the README table lists eight: `fix-issue` and `resolve-backport-conflicts` are missing.
- `deep-app-audit` and `ship-it` start separate agent processes, so they use a lot of subscription tokens.
- `/draft-security-advisory`, `/deep-app-audit` and `/ship-it` run only when called by hand and never trigger on their own.
- `deep-app-audit` needs a test site and an agent CLI that the script launches for each task.
- There is no license file at the repository root.
How to disable. Delete the folders you no longer want from the agent's skills directory, for example `frappe-app-dev` or `ship-it`. `deep-app-audit` results stay as report files on disk.
FAQ
How do I install just one skill from Frappe Skills?
Add the `--skill` flag with the skill name: `npx skills add frappe/skills --skill frappe-app-dev`. Repeat the flag for several skills. The name comes from the `name` field in `SKILL.md`.
Which skills run only when called by hand?
`/draft-security-advisory`, `/deep-app-audit` and `/ship-it`. The rest trigger on their own when the request fits: a DocType question, `bench migrate` or a diff review.
Will /ship-it merge my PR?
No. The skill takes the work to a merge-ready PR and watches CI, and the merge itself stays with a human.
How is frappe-app-dev different from the set's general skills?
`frappe-app-dev` works with the framework itself: DocTypes, hooks, the ORM and `bench`. The `code-style`, `technical-writing` and `ui-design` skills are not tied to Frappe and fit any project.
What does deep-app-audit check?
Security by area, plus correctness and customization rules. Each finding is verified in a fresh context and the result is one report. The `scripts/run_audit.py` script starts the tasks through an agent CLI.
Discussion
No questions or reviews yet.
Related
Skills14 Frappe skills for DocTypes, APIs, Desk UI, Vue frontends, reports and tests, so the agent stops writing outdated patterns
61 skills that teach Claude to write and run Frappe and ERPNext code for versions 14 to 16, from scripts to deployment.
Nine short skills: tests, review, ADR plans, slides, a wiki, image generation, worktrees and plan implementation.
A personal set of 15 skills: code review, PRD and tasks, an implementation orchestrator, tests and bug hunting.
Five skills for daily development: requirement interviews, AGENTS.md rules, PR review triage and single-file HTML design.
Nine JS Mastery skills take a change through phases: from idea and spec to verification, tests, release texts and a docs sync
README in short
The README lists the skills in a table with each one's scope, then gives three install variants: all skills, one, or several. It ends by explaining that some skills trigger automatically on the request topic and three are called by command.
README badge
Original SKILL.md
--- name: frappe-app-dev description: >- Builds full-stack Frappe Framework applications end-to-end. Use this skill any time the user mentions: creating or modifying a DocType, writing a controller or lifecycle hook, adding a whitelisted API, setting up a new Frappe app or bench site, building a desk form or list view, creating portal pages, writing background jobs or scheduled tasks, managing permissions or roles, writing Frappe tests, or working with frappe.db / frappe.qb. Also applies when the user says things like "how do I hook into save", "add a field to a DocType", "create a REST endpoint in Frappe", "run bench migrate", or "install an app on a site" — even if they don't explicitly say "Frappe". --- # Frappe Full-Stack App Builder ## Global Rules - Use bare `bench`. Not `./env/bin/bench`. Not a full path. - Do not run `which bench`, `bench --version`, `bench --help`, or check frappe version. No discovery commands. - Do not delegate bench detection to a subagent. Run `ls apps/ sites/ Procfile` yourself. - Do not create DocType folders with `mkdir`. Frappe creates them via `bench migrate`. - Run `bench start` in a background process only. - Before running `bench start`, check if it's already running in an existing terminal. Do not start a second instance. - Always pass `--site <site>` explicitly to bench commands. Never run bare `bench migrate`. ## Flow Selection Determine which flow applies, then read ONLY the relevant file: ### Creating a brand new app Read [new-app.md](./references/new-app.md) — covers bench setup, app scaffolding, site creation, and installation. ### Working on an existing app Read [existing-app.md](./references/existing-app.md) — covers finding the bench, locating the app, confirming site, and extending features. ## Feature References Load ONLY the references needed for the current task: | Topic | When to load | File | | ---------------- | -------------------------------------------- | ------------------------------------------------------- | | Site management | Finding/creating/managing sites | [site-management.md](./references/site-management.md) | | DocTypes | Creating/modifying DocTypes, fields, naming | [doctypes.md](./references/doctypes.md) | | Controllers | Document lifecycle, server logic | [controllers.md](./references/controllers.md) | | Whitelisted APIs | REST endpoints, `@frappe.whitelist()` | [api.md](./references/api.md) | | Database & ORM | `frappe.db`, queries, raw SQL | [database.md](./references/database.md) | | Caching | Redis, `frappe.cache` | [caching.md](./references/caching.md) |