SuiteCloud Agent Skills: AI-Assisted Dev Guidance for SuiteScript, SDF, and Security

What changed

Oracle now publishes a growing library of SuiteCloud Agent Skills — structured knowledge packs designed to be consumed by AI coding assistants (Claude, Copilot, etc.). Each skill is a downloadable ZIP that provides guardrails, reference data, and workflow guidance for a specific SuiteCloud domain. They are platform-agnostic and not tied to any single IDE or AI provider.

Skills available at initial launch

• netsuite-ai-connector-instructions — Guardrails for AI-to-NetSuite sessions via the AI Service Connector: safe SuiteQL usage, correct tool selection, multi-subsidiary/currency handling, and output formatting.
• netsuite-sdf-roles-and-permissions — Generates and validates SDF permission configurations (custom role XML, script deployment permissions) against NetSuite reference data. Useful for reviewing permission IDs and levels.
• netsuite-uif-spa-reference — API and type lookup for @uif-js/core and @uif-js/component: constructors, methods, props, enums, hooks, and component options for UIF SPA development.

Skills added in subsequent updates

• netsuite-sdf-project-documentation — Generates documentation for SDF projects by analyzing scripts, object XML, manifest.xml, and SuiteQL queries. Outputs README files, Mermaid/ASCII architecture diagrams, deployment guides, and troubleshooting tables. Can hook into post-deployment workflows.
• netsuite-suitescript-records-reference — Field-level reference for all 272 NetSuite record types: field IDs, types, required status, and search capability. Eliminates guesswork when writing N/record or N/search calls.
• netsuite-owasp-secure-coding — OWASP Top 10 (2021) guidance with JavaScript/Node.js and SuiteScript-specific patterns. Covers output encoding, injection prevention, CSP headers, file security, API hardening, AI agent security, and 48+ documented pitfalls with good/bad code templates.
• netsuite-suitescript-upgrade — Migration assistant for SuiteScript 1.0 → 2.0 → 2.1 upgrades. Covers 125+ API mappings, 34 object conversions, 13 unmapped API workarounds, entry-point changes per script type, and 16 categories of breaking behavioral changes. This is the most directly code-impacting skill for teams still running SS1.0 or SS2.0.
• netsuite-sdf-safe-guide — Comprehensive best-practices skill based on the SAFE Guide (12 principles plus appendices). Generates Object XML for all 14 script types, enforces governance limits, and covers N/cache, N/query, concurrency limits, OAuth 2.0, legacy TBA guardrails, CustomTool runtime patterns, REST Web Services (2026.1 features), and 139+ documented pitfalls.
• netsuite-suitescript-learning — Interactive learning system with six modes (learn, review, explain, annotate, quiz, final) integrated with the SAFE Guide. Generates compliance-reviewed documentation and quizzes from code or SAFE Guide content.
• netsuite-finance-analyst — Financial analysis workflows: period-end/month-end close, income statement/balance sheet/cash flow analysis, budget-vs-actual variance, AR/AP aging, reconciliation, journal entry review, SOX checks, and CFO-ready narratives. Not a developer skill — targets Director of Financial Analysis use cases.

What to do

1. Download the ZIP files from the SuiteCloud Agent Skills 1.0 page in the Help Center or from the SuiteCloud Agent Skills GitHub repository.
2. Install the relevant skills into your AI assistant. Installation is platform-agnostic — follow the instructions for your specific tool (e.g., npx skills add for Claude Code, or load into your IDE's AI context).
3. Prioritize netsuite-suitescript-upgrade if you have legacy SS1.0 or SS2.0 code. The 125+ API mappings and 16 categories of breaking changes make it a practical companion for migration work.
4. Adopt netsuite-sdf-safe-guide for new SuiteApp and Account Customization projects. It encodes governance-limit enforcement and security patterns that are otherwise scattered across help topics.
5. Use netsuite-suitescript-records-reference to replace manual Record Browser lookups when writing scripts — it covers all 272 record types with field IDs and searchability flags.
6. Review netsuite-owasp-secure-coding if your SuiteScripts handle user input, external API calls, or file operations. The 48+ pitfall templates are a fast way to audit existing code.

Notes

These skills are not runtime components — they do not deploy to NetSuite or affect account behavior. They are reference and guidance artifacts consumed by AI tools at development time. There is no SuiteScript API change, no new record type, and no WSDL impact. The value is entirely in reducing human error during development by encoding Oracle's own best-practice documentation into a machine-readable format.

Oracle's release note is light on versioning details for individual skills. The ZIP download is labeled "1.0" but there is no documented changelog per skill. If you are evaluating these for a controlled development environment, pin the ZIP version you download and diff against future releases manually.