security
Review Odoo PRs with an Expert Agent: odoo-code-review
Scenario-driven guide to odoo-code-review: an agent skill that scores Odoo PRs against version-specific standards, from setup to adoption.
Where this fits
You're a Python developer maintaining an Odoo module. A contributor opens a PR that touches models, security rules, and a QWeb template. You have two hours to review it, but Odoo 18 introduced new ORM constraints and deprecations that you haven't fully internalized. Instead of scanning the diff manually and guessing, you delegate the first pass to an agent equipped with odoo-code-review. It resolves the target version, checks against the official reference pack, and returns a weighted score report you can act on immediately.
Why agents benefit
- Version-aware review: Automatically resolves the Odoo version (16–19) from project config or manifest, then applies the correct standards—no more mixing up 17 vs. 18 API changes.
- Weighted scoring: Produces a quantitative report where security, correctness, performance, and style have explicit weights, so you can prioritize fixes by risk.
- Security-first focus: Catches common Odoo pitfalls like unsafe
sudo()usage, missing record rules, or SQL injection viasearch()filters before they hit production. - Consistent, repeatable checks: Every PR gets the same rigorous treatment, eliminating reviewer fatigue and personal bias.
- Seamless integration: Works as a standard skill in your agent workflow, reading diffs or whole modules without extra setup.
Practical scenarios
Pre-merge security audit for a community module
A contributor submits a new ir.model.access.csv and a model method that uses request.env. The agent flags that the method lacks an explicit sudo() and that the access rules don't cover a new field. It scores security 6/10, blocking the merge until fixed.
Upgrading a legacy module to Odoo 18
You're migrating a module from 16 to 18. The agent detects deprecated api.one usage and old-style fields.function definitions, then suggests the modern computed approach. It also verifies that the new @onchange behavior matches 18's stricter signature.
Reviewing a large refactor across multiple files
The agent scans a 1,200-line diff, categorizes changes, and highlights performance risks like N+1 queries in read_group or missing index=True on frequently filtered fields. It produces a breakdown by file and severity, saving you an hour of manual tracing.
Add it to your agent workflow
Install the skill with:
npx skills add unclecatvn/agent-skills --skill odoo-code-review
Then invoke it in a prompt, e.g.:
Review the PR diff in this repo for Odoo 18.0. Focus on security and performance. Output a scored report with recommendations.
The agent will resolve the version (argument > .odoo-version > manifest > fallback 19.0) and generate a structured review.
Compare before adopting
Before committing to this skill, compare it against alternatives like generic code review agents or manual checklists. Look for:
- Quality signals: Does it reference official Odoo source code and docs? Are the scoring criteria transparent?
- Maintenance freshness: Check the GitHub repo for recent commits and issues. A skill that hasn't been updated for Odoo 19 may miss new deprecations.
- Alternatives: Consider general-purpose linters (e.g.,
pylint-odoo) that lack scoring or context, or custom prompts that require manual version setup. - Workflow fit: Ensure it can read your repo structure and respect your version pinning. Test it on a small PR first.
Why it is worth tracking
With 130 stars and an active author, odoo-code-review shows steady community adoption. Its version-aware approach addresses a real pain point—Odoo's rapid release cycle—and its weighted scoring gives you actionable, prioritized feedback. Track it if you regularly review Odoo code, and re-evaluate when new Odoo versions drop or if the skill adds support for custom criteria. For a one-stop overview, see the skill's OpenAgentSkill page.
Featured Skill
odoo-code-review
Skill by unclecatvn