theme-create

Pass

Audited by Gen Agent Trust Hub on Oct 5, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides instructions for the agent to execute shell commands to update the Odoo module list and install generated themes.
  • Evidence: python -m odoo -c conf/<PROJECT>.conf -d <DB> --update-list and python -m odoo -c conf/<PROJECT>.conf -d <DB> -i theme_<name> --stop-after-init in the 'Installation & Testing' section.
  • [DYNAMIC_EXECUTION]: The skill generates Python models and Odoo manifest files that are loaded and executed by the Odoo server during runtime.
  • Evidence: Generation of __init__.py, __manifest__.py, and models/theme_<name>.py files as part of the theme structure.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user prompts and potentially external design data (e.g., Figma design tokens) to generate theme content, creating an attack surface for indirect instructions to be incorporated into generated code.
  • Ingestion points: User requests for specific theme designs and Figma design extraction (SKILL.md).
  • Boundary markers: None identified in the provided templates.
  • Capability inventory: The skill has Write, Edit, and Bash capabilities to generate and install code.
  • Sanitization: There is no explicit logic described for sanitizing or escaping user-provided design descriptions before they are written to files.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 5, 2026, 10:53 AM