The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The insightpulse.connection.endpoint model stores sensitive fields like password and api_key using standard Odoo Char fields. In Odoo environments, these fields are stored as plain text in the underlying PostgreSQL database unless an additional encryption layer is implemented. While the user interface masks these values, they remain accessible in the database layer.
[DATA_EXFILTRATION]: The security access file security/ir.model.access.csv grants full Read, Write, Create, and Unlink permissions for the connection endpoints to the base.group_user group. In Odoo, this group includes all internal employees, meaning any user with system access can retrieve and potentially modify sensitive infrastructure credentials for Supabase, Superset, and other production databases.
[EXTERNAL_DOWNLOADS]: The skill's documentation in README.md and SKILL.md recommends installing external Python dependencies from public registries, specifically psycopg2-binary, to enable connection testing functionality. This follows the [TRUST-SCOPE-RULE] for well-known registries but should be noted as a runtime requirement.
[DATA_EXFILTRATION]: The skill presents an indirect prompt injection surface by managing and processing external connection data.
Ingestion points: Connection configuration fields (host, port, database name) in models/connection_endpoint.py and data/default_endpoints.xml.
Boundary markers: None identified; configuration values are directly interpolated into connection strings and environment variables.
Capability inventory: Database connection testing using psycopg2 and external API interaction via requests as described in SKILL.md logic.
Sanitization: None; credentials and connection parameters are stored and used without validation or escaping.

insightpulse-connection-manager