odoo-migrate

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting data from external web sources and local module files, which presents a surface for indirect instructions to influence agent behavior.
  • Ingestion points: Processes Odoo module manifest files (__manifest__.py, __openerp__.py), Python source code, XML views, and external documentation retrieved from the OCA wiki via WebFetch.
  • Boundary markers: The instructions lack specific delimiters or negative constraints to prevent the agent from following instructions embedded within the processed code or documentation.
  • Capability inventory: The skill possesses file read/write capabilities, network access via WebFetch, and the ability to execute shell commands for code validation.
  • Sanitization: No explicit sanitization or validation of the ingested content is performed before it is used to guide code modifications.
  • [COMMAND_EXECUTION]: The skill uses local command execution to verify the integrity of the migrated code.
  • Evidence: Step 5 instructs the agent to run python -m py_compile on the module's Python files to check for syntax errors after modifications have been applied.
  • [EXTERNAL_DOWNLOADS]: The skill retrieves technical guidelines from a remote repository to inform the migration process.
  • Evidence: Fetches migration documentation from the Odoo Community Association (OCA) GitHub wiki (e.g., https://github.com/OCA/maintainer-tools/wiki/Migration-to-version-17.0).
  • [DYNAMIC_EXECUTION]: The skill involves writing code and then performing a compilation-based syntax check at runtime.
  • Evidence: The workflow involves programmatically applying changes to Python files (Step 4b) and then running the Python compiler module (py_compile) to validate the generated source (Step 5).
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 10:34 AM