odoo-web
Pass
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill focuses entirely on teaching secure development practices for the Odoo framework. No malicious patterns, obfuscation, or unauthorized data access techniques were detected.
- [SAFE]: The instructions emphasize robust security measures, including the correct application of Odoo's authentication levels ('user', 'public', 'none'), the necessity of CSRF protection for session-based routes, and the use of signed access tokens for portal document security.
- [SAFE]: The skill provides defensive coding patterns, such as verifying record existence with
.exists()after browsing IDs to prevent 500 errors and ensuring thatsudo()is used narrowly with documented reasoning rather than as a blanket privilege escalation. - [SAFE]: While the skill involves creating endpoints that ingest external data (Category 8 surface), it mitigates Indirect Prompt Injection risks by explicitly instructing on input validation, schema enforcement (casting to
int), and respecting Odoo's internal Access Control Lists (ACL) and record rules.
Audit Metadata