odoo-upgrade

Pass

Audited by Gen Agent Trust Hub on Jul 28, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill is a specialized developer tool for Odoo 18 to 19 migration. It is designed to operate on local source code and employs standard Odoo and Docker utilities for verification purposes.
  • [COMMAND_EXECUTION]: Several scripts, including upgrade_verify.py, db_upgrade.py, and migrate_all.py, execute shell commands via subprocess.run to orchestrate Docker containers and Odoo instances. These actions are essential for the tool's core functionality (runtime verification and database rehearsal) and are implemented with standard parameter handling.
  • [EXTERNAL_DOWNLOADS]: The db_upgrade.py script facilitates the installation of the openupgradelib package using the standard Python package manager (pip). This is a legitimate and well-known dependency within the Odoo OpenUpgrade ecosystem.
  • [DATA_EXFILTRATION]: Analysis of the network activity and file access patterns shows no evidence of unauthorized data transmission. Operations are confined to local environments or managed Docker volumes.
  • [PROMPT_INJECTION]: As a code migration tool, this skill ingests and transforms Odoo addon code (Python, XML, JavaScript). This represents a surface for indirect prompt injection (Category 8). However, this risk is a fundamental property of the tool's function and is handled safely within a developer-controlled workflow.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 28, 2026, 07:45 PM
Security Audit — agent-trust-hub — odoo-upgrade