odoo-test
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/test_runner.pyscript utilizessubprocess.Popento wrap the Odoo test framework's command-line interface. The command is constructed as a list of arguments rather than a single shell string, which is a best practice to prevent command injection. This functionality is essential for the skill's primary purpose of executing test suites. - [INDIRECT_PROMPT_INJECTION]: The toolkit includes scripts (
coverage_reporter.py,mock_data_factory.py, andtest_generator.py) that read and analyze Odoo module source code. - Ingestion points: Python source files (.py) within the provided Odoo module directory are read and parsed using the
astmodule to identify models, fields, and methods. - Boundary markers: The analysis scripts do not implement specific boundary markers or instructions to ignore embedded natural language prompts within the source code being analyzed.
- Capability inventory: The skill possesses capabilities for writing new test files to the local filesystem (
test_generator.py) and executing system commands (test_runner.py). - Sanitization: The scripts utilize Abstract Syntax Tree (AST) analysis for parsing, which prevents common code injection risks during the analysis phase, although the tool does not specifically filter for natural language instructions that might be embedded in code comments or strings.
Audit Metadata