odoo-app-automator
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides legitimate Odoo 19 development patterns, documentation, and module scaffolding logic aligned with Odoo Community Association (OCA) standards.
- [EXTERNAL_DOWNLOADS]: Includes references to well-known libraries (requests, pandas, paddleocr) and official service endpoints (Supabase) that are integral to the skill's stated purpose of financial automation and document processing.
- [COMMAND_EXECUTION]: Describes the use of standard Odoo CLI tools (odoo-bin) for installing, updating, and testing modules within development and staging environments.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface due to its core function of generating executable code from user-defined requirements. 1. Ingestion points: User-provided descriptions of business processes, data models, and entity requirements (found in SKILL.md under Requirement Gathering). 2. Boundary markers: The skill lacks explicit delimiter-based warnings to ignore potentially malicious instructions embedded in the user's requirements. 3. Capability inventory: Subprocess execution of Odoo management commands and network operations to external APIs via the requests library (documented across SKILL.md and reference files). 4. Sanitization: While the skill provides guidelines for secure coding (e.g., using record rules and field-level security), it does not implement active input sanitization for the data passed into the generation logic.
Audit Metadata