odoo-woocommerce-bridge
Pass
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill provides legitimate integration logic for synchronizing ERP and e-commerce platforms using standard API patterns.
- [SAFE]: Secure credential management is demonstrated through the use of environment variables (
os.getenv) for sensitive API keys and passwords. - [EXTERNAL_DOWNLOADS]: The skill references the standard
woocommercePython library for WooCommerce REST API interactions. - [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface as it is designed to ingest data from an external API (WooCommerce) and process it into another system (Odoo).
- Ingestion points: External order data, including customer billing information and line items, is retrieved via the WooCommerce API call
wcapi.get("orders", ...)inSKILL.md. - Boundary markers: Absent. The instructions and code templates do not include delimiters or specific instructions for the agent to treat external content as untrusted.
- Capability inventory: The skill possesses the capability to write records to the Odoo ERP database using
models.execute_kwfor theres.partnerandsale.ordermodels. - Sanitization: The provided Python examples do not include validation or sanitization of the retrieved WooCommerce data before it is interpolated into Odoo database operations.
Audit Metadata