odoo-shopify-integration

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill's example code hardcodes an Odoo credential (pwd = "api_key") and then uses that variable directly in XML-RPC calls, which requires embedding secret values verbatim in generated code/requests.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md describes a Shopify webhook receiver route that ingests the outsider-authored Shopify order JSON body at runtime (e.g., shopify_order = request.json), which the integration would then use to create Odoo records.