odoo-woocommerce-bridge

Pass

Audited by Gen Agent Trust Hub on Aug 9, 2026

Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [SAFE]: The skill provides legitimate integration logic for synchronizing ERP and e-commerce platforms using standard API patterns.
  • [SAFE]: Secure credential management is demonstrated through the use of environment variables (os.getenv) for sensitive API keys and passwords.
  • [EXTERNAL_DOWNLOADS]: The skill references the standard woocommerce Python library for WooCommerce REST API interactions.
  • [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface as it is designed to ingest data from an external API (WooCommerce) and process it into another system (Odoo).
  • Ingestion points: External order data, including customer billing information and line items, is retrieved via the WooCommerce API call wcapi.get("orders", ...) in SKILL.md.
  • Boundary markers: Absent. The instructions and code templates do not include delimiters or specific instructions for the agent to treat external content as untrusted.
  • Capability inventory: The skill possesses the capability to write records to the Odoo ERP database using models.execute_kw for the res.partner and sale.order models.
  • Sanitization: The provided Python examples do not include validation or sanitization of the retrieved WooCommerce data before it is interpolated into Odoo database operations.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 9, 2026, 10:27 PM
Security Audit — agent-trust-hub — odoo-woocommerce-bridge