odoo-woocommerce-bridge
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from WooCommerce orders that could contain malicious instructions.
- Ingestion points: WooCommerce order data is fetched via
wcapi.get("orders", ...)inSKILL.mdand fields likeemail,first_name,last_name, andaddress_1are used to create records in Odoo. - Boundary markers: No boundary markers or 'ignore embedded instructions' warnings are present in the provided Python snippets.
- Capability inventory: The skill uses XML-RPC to perform search and create operations in Odoo (
models.execute_kw) and makes network PUT requests to update WooCommerce order statuses. - Sanitization: The provided code does not demonstrate sanitization or validation of the external WooCommerce data before it is processed or used to populate Odoo database fields.
Audit Metadata