The Agent Skills Directory

[COMMAND_EXECUTION]: The master script scripts/security_auditor.py manages sub-auditor execution via subprocess.run. It securely passes arguments as a list and avoids shell invocation, which prevents command injection risks during the orchestration of audit tasks.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted codebase files to perform its security audits, which is an inherent attack surface. The risk is minimized as the skill performs read-only static analysis and presents findings in a structured report format.
Ingestion points: User-provided Odoo module files are read and processed by auditing scripts in the scripts/ directory.
Boundary markers: None; audited content is treated as raw data for parsing.
Capability inventory: The skill uses standard agent capabilities to read files and execute its internal Python-based auditing scripts.
Sanitization: The toolkit uses the Python ast (Abstract Syntax Tree) module for structured code analysis, ensuring that the audited code is not executed during the scanning process.
[DYNAMIC_EXECUTION]: The auditing tools utilize the ast module to dynamically inspect code structure at runtime. This implementation is safe and appropriate for static analysis tooling as it does not involve the execution of the target code or untrusted inputs.

odoo-security