theme-create
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for the agent to execute shell commands to update the Odoo module list and install generated themes.
- Evidence:
python -m odoo -c conf/<PROJECT>.conf -d <DB> --update-listandpython -m odoo -c conf/<PROJECT>.conf -d <DB> -i theme_<name> --stop-after-initin the 'Installation & Testing' section. - [DYNAMIC_EXECUTION]: The skill generates Python models and Odoo manifest files that are loaded and executed by the Odoo server during runtime.
- Evidence: Generation of
__init__.py,__manifest__.py, andmodels/theme_<name>.pyfiles as part of the theme structure. - [INDIRECT_PROMPT_INJECTION]: The skill processes user prompts and potentially external design data (e.g., Figma design tokens) to generate theme content, creating an attack surface for indirect instructions to be incorporated into generated code.
- Ingestion points: User requests for specific theme designs and Figma design extraction (SKILL.md).
- Boundary markers: None identified in the provided templates.
- Capability inventory: The skill has
Write,Edit, andBashcapabilities to generate and install code. - Sanitization: There is no explicit logic described for sanitizing or escaping user-provided design descriptions before they are written to files.
Audit Metadata