odoo-migrate
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting data from external web sources and local module files, which presents a surface for indirect instructions to influence agent behavior.
- Ingestion points: Processes Odoo module manifest files (
__manifest__.py,__openerp__.py), Python source code, XML views, and external documentation retrieved from the OCA wiki via WebFetch. - Boundary markers: The instructions lack specific delimiters or negative constraints to prevent the agent from following instructions embedded within the processed code or documentation.
- Capability inventory: The skill possesses file read/write capabilities, network access via WebFetch, and the ability to execute shell commands for code validation.
- Sanitization: No explicit sanitization or validation of the ingested content is performed before it is used to guide code modifications.
- [COMMAND_EXECUTION]: The skill uses local command execution to verify the integrity of the migrated code.
- Evidence: Step 5 instructs the agent to run
python -m py_compileon the module's Python files to check for syntax errors after modifications have been applied. - [EXTERNAL_DOWNLOADS]: The skill retrieves technical guidelines from a remote repository to inform the migration process.
- Evidence: Fetches migration documentation from the Odoo Community Association (OCA) GitHub wiki (e.g.,
https://github.com/OCA/maintainer-tools/wiki/Migration-to-version-17.0). - [DYNAMIC_EXECUTION]: The skill involves writing code and then performing a compilation-based syntax check at runtime.
- Evidence: The workflow involves programmatically applying changes to Python files (Step 4b) and then running the Python compiler module (
py_compile) to validate the generated source (Step 5).
Audit Metadata