odoo-code-review
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a purely instructional guide for an AI agent to perform code reviews. It defines logical steps for version detection, scope identification, and technical evaluation without incorporating dangerous commands or external dependencies.- [DATA_EXPOSURE]: The skill instructs the agent to read local configuration files (e.g., .odoo-version, odoo.json) and manifest files to determine the target Odoo version. This is standard behavior for development tools and does not constitute unauthorized data exposure.- [INDIRECT_PROMPT_INJECTION]: As the skill is designed to process external code (Odoo modules, diffs, and pull requests), it theoretically possesses an attack surface for indirect prompt injection. However, the skill includes explicit version validation (limiting ODOO_VERSION to 16.0-19.0) and does not instruct the agent to execute the code being reviewed, which significantly mitigates risk.
- Ingestion points: Workspace files including manifest.py, .odoo-version, and user-provided code diffs.
- Boundary markers: Not explicitly defined in this instruction file.
- Capability inventory: File reading (implied by the review process).
- Sanitization: Includes a version whitelist check (16.0, 17.0, 18.0, 19.0) before path construction.
Audit Metadata