In the first week of November, a rather inconspicuous directory quietly appeared in Odoo's GitHub repository: skills/. It contained no new features, no new modules, only four documents for AI to read.
Almost at the same time, an ERP observatory in the German-speaking region took stock: of the 36 ERP systems in the DACH market, only 10 can now be connected to AI, whereas in March this year that number was still 3; as for the other 17, neither vendors nor implementation partners have any path to AI at all.
Looking at these two things together reveals a turning point that is easily overshadowed by big headlines such as 'agents taking over ERP': the focus of competition is shifting from 'whether AI can connect to ERP' to 'according to whose rules AI modifies ERP.'
1. An Official Yardstick: Turning Coding Standards into Skills That AI Can Load Directly
According to much. Consulting's "Odoo News November 2026" (November 2026), Odoo added a skills directory to its official GitHub repository, specifically to teach AI coding agents such as Claude Code, Copilot CLI, Codex, and OpenCode to review and write Odoo code "in Odoo's own way." The directory contains four skills: one code review, one security audit, and two coding standards (for core and web code respectively). In the community, Ray Carnes was one of the first to point out this change.
Domestic technical team Xian'an Technology cross-verified from the source code perspective: the top level of the Odoo 20.0 repository newly adds skills/, containing four built-in documents: odoo-guidelines, odoo-review, odoo-security, and odoo-web-guidelines. The security audit one covers things very concretely—sudo misuse, SQL injection and domain injection, RPC exposure, XSS—which are exactly the types of issues that are easiest to run into and have the most serious consequences in Odoo secondary development.
| Odoo 20.0 official skills/ | Constraint Object | Typical risk points |
|---|---|---|
| odoo-guidelines | Core-side framework and ORM usage | Version Mismatch, Model Inheritance, and Field Usage |
| odoo-web-guidelines | Owl / Web client code | Misuse of registry, services, and view components |
| odoo-review | Pre-submission code review | Readability and maintainability issues |
| odoo-security | Security Audit | sudo misuse, SQL/domain injection, RPC exposure, XSS |
Even more noteworthy is the community's reaction. In the alignment meeting notice issued by the OCA (Odoo Community Association) AI PSC on October 8, contributors explicitly proposed that OCA's AI modules should also follow the skill format defined in the Odoo 20 README—that is, the open specification of agentskills.io; the meeting is scheduled for October 26, with agenda items including unifying the terminology, clarifying the two paths of "Odoo Bridge" and "Odoo AI Agent", naming conventions, and the module map. In other words, once the official specification lands, the ecosystem begins to converge on the same format.
In the past, ERP vendors delivered documentation, training, and partner certification, with standards relying on people to remember them and reviews to keep an eye on them. Now the standards themselves have been written as machine-loadable, versionable assets—they are no longer merely "suggestions," but default constraints that an agent must read in before taking action.
In the context of open-source ERP, this move carries more weight: the code is fully open and the scope for secondary development is enormous; while AI coding agents amplify efficiency, they also amplify technical debt proportionally. Putting the “yardstick” into the repository is tantamount to first installing a calibrator for this force.
II. Why Now: AI writes code faster than humans can review it
In Gartner’s “Top 10 Strategic Technology Trends for 2027,” it gave a very stark timeline: by the end of 2026, 20% of public code commits will come from autonomous coding agents, and closed-loop control frameworks will become an essential requirement for software delivery. At a media briefing on November 3, Research Vice President Arnold Gao (Gao Ting) explained the reason bluntly: “The speed of code generation has already surpassed the speed of manual review. Without an agent framework, it will lead to governance misalignment and constant rework.”
20%
Gartner: By the end of 2026, public code commits will come from autonomous coding agents (prediction)
10 / 36
In the DACH market, only 3 ERP systems can be connected by AI as of March 2026 (ERP Checker statistics)
The bottleneck on the demand side is equally clear. The same Odoo News November 2026 cites a survey covering 150 manufacturing enterprises: 86% cite "lack of internal resources" as the biggest obstacle to introducing or modernizing ERP, but 64% still plan to budget for ERP, digitalization, or process automation in the next two years. Not enough people, but the money is still there—the result can only be one thing: more implementation and secondary development work will be handed over to AI coding agents.
So the card of "can it connect to AI" is also beginning to diverge in value. The statistics given by Max Mittelstaedt of ERP Checker are that of 36 DACH ERPs, 10 can connect and 17 have no path at all; much. Consulting seized the moment to propose four questions that should be asked during selection, which I think are far more practical than the promotional phrasing of "does it have AI features":
① Is the MCP Server from the vendor or a third party? The source is the first layer of the responsibility boundary.
② Can AI only read, or can it also create documents? Read-only and writable are completely different risk levels.
③ Are ERP user permissions equally effective for AI? If permissions are not inherited, it is equivalent to opening a backdoor.
④ How is usage billed, and what happens after the beta period ends? The cost model should be calculated on a long-term basis.
Connect these four questions with Odoo's skills directory, and you'll see a complete governance chain: the connection layer addresses "can it get in," the permission layer addresses "what can be touched," and the coding layer addresses "whether what gets changed looks like what this ERP ought to look like." The first two layers have been discussed a great deal this year; the third has only just begun.
III. The Neglected Link: The Skill File Itself Is the New Supply Chain
A bucket of cold water must be poured here. Handing the specification over to AI to load is premised on this skill file itself being trustworthy—and reality is not encouraging.
Snyk's ToxicSkills study, published on February 5, 2026, scanned 3,984 public skills: 13.4% (534) had at least one critical-severity security issue, and 36.82% (1,467) had defects of any severity; manual review confirmed 76 with active malicious payloads, 8 were still installable when the report was published, and 91% of the confirmed malicious samples also used prompt injection. Snyk's description of the publishing threshold is almost ironic: a SKILL.md file plus a GitHub account registered for a full week—no code signing, no security review, and no sandbox by default.
Snyk ToxicSkills: Of 3,984 public agent skills, 534 contain critical-severity security issues (2026-02-05)
The conclusions on the academic side are even less optimistic. The USENIX Security 2026 paper “Do Not Mention This to the User” conducted behavioral validation on 98,380 skills, confirming 157 malicious skills and 632 distinct vulnerabilities, of which 84.2% of the vulnerabilities were hidden in natural-language SKILL.md, rather than in scripts; a single actor accounted for 54% of confirmed cases. The Skill-Inject benchmark included in NeurIPS 2026 shows that, when facing skills containing injections, the attack success rate against frontier models can reach as high as 80%, with behaviors including data exfiltration and destructive actions.
The crux is: a skill is not a "document", but "instructions plus scripts that run with all the permissions of the agent that loads it". It has shell access, can read credentials in environment variables, and can read and write the file system. OWASP created the Agentic Skills Top 10 specifically for this, placing "malicious skills" (AST01) first. Skills in vendors' official repositories are highly trustworthy, but the ones enterprises install themselves from the community, or the copy a consultant casually clones, are a different matter.
That is also why the October batch of open-standard moves is worth looking at together: Anthropic donated the Agent Skills specification to the Agentic AI Foundation under the Linux Foundation, and the specification is supported by 35+ platforms (Cursor, VS Code, GitHub Copilot, Codex, Gemini CLI, etc.). But what the foundation governs is the format, not the distribution channel—it does not provide an official registry, nor does it perform pre-release review. The format is portable, but trust judgment remains the enterprise's own responsibility.
IV. Practical Advice for CIOs: Include "AI Coding Standards" in the ERP Governance Checklist
We've talked about this at length, so let's get down to execution. If you are using or preparing to adopt open-source ERP, I suggest adding the following four things to this year's governance checklist, rather than waiting until something goes wrong to patch them in.
1. Establish an internal skill registry. Record each skill's purpose, owner, version, dependencies (MCP Server, packages, external services), and most recent assessment date, and link it to which agents are using it. Use only official repositories or self-built skills, lock by version, verify checksum at deployment, and avoid "trusting a repository that can be silently changed."
2. Reviews must have separation of duties. Read all files, run scripts/ in a sandbox, search for network calls and credential paths, and do not let skill authors review their own skills. Anthropic's enterprise guidance likewise emphasizes: treat skills as a link in the software supply chain.
3. Explicitly write version differences into the specification.The breaking points from Odoo 19→20 are very specific: ir.model.access.csv is renamed to ir.access.csv and the permission model is merged, ai.topic becomes ai.skill, and secondary-development interfaces are extensively rewritten. If skill files do not carry version annotations, AI can easily inject 20.0 syntax into a 19.0 project—this kind of "seemingly runnable" error is more expensive than a direct error.
4. Write operations still retain a human gate. Before AI-generated code enters the production repository, it goes through the same CI and audit trail as human-written code; high-stakes actions (posting, payments, bulk changes to master data) are not authorized for autonomous execution by agents.
There is also a longer-term judgment. In the same 2027 trends report, Gartner says that tool software with simple functions, limited differentiation, and short cycles, as well as some traditional SaaS, will be impacted by AI generation, but core software such as ERP and CRM will not be replaced quickly, because what they truly provide is enterprise business logic and industry knowledge, not just the software itself. The implication of this statement for CIOs is: you do not need to rush to tear down ERP and start over, but you must begin to consolidate "business logic" into machine-readable, auditable, and versionable assets—the four documents Odoo has placed in the repository this time are a very small but very standard sample.
Finally, back to those two numbers: 10/36 and 4 documents. The former shows that “connecting to AI” has only just passed a quarter, while the latter shows that leading open-source vendors are already building infrastructure for “what to do after connecting.” When selecting a solution, asking one more question—whether this vendor has written its own specifications in a form that AI can read, review, and trace—may be more valuable than comparing ten more feature points.
Sources: much. Consulting, 'Odoo News November 2026' (2026-11, including the official skills catalog, MCP statistics for DACH ERP, a survey of 150 manufacturing enterprises, and four selection questions); Xian'an Technology, 'Viewing Odoo 20.0's AI from the Code' (2026-11); OCA AI module alignment meeting notice (2026-10-08); Gartner, 'Top 10 Strategic Technology Trends for 2027,' and Gao Ting media briefing (Zhidongxi, 2026-11-03); Snyk, 'ToxicSkills' (2026-02-05); USENIX Security 2026, Skill-Inject (NeurIPS 2026), and OWASP Agentic Skills Top 10 (cited via a public review); Agentic AI Foundation and the agentskills.io specification (2026-10). Forecast data have all been marked; survey data are cited according to the original source's definitions, without extrapolation. As of 2026-11-07.
Zhongdi Information · Specializing in Odoo and digital solutions for enterprise management
