odoo-code-tracer
Pass
Audited by Gen Agent Trust Hub on Aug 5, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a template for code analysis. It instructs the AI agent to follow a specific methodology for tracing Odoo execution flows.
- [DATA_EXPOSURE]: The skill reads project configuration files such as
.odoo-version,package.json, andpyproject.tomlto determine the target Odoo version. This is standard behavior for development tools and does not involve sensitive credential harvesting. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it ingests untrusted code from an Odoo workspace. However, it is primarily an analysis tool with no capabilities to execute code, write files, or perform network operations.
- Ingestion points: Source code files (
.py,.js,.xml) and manifest files (__manifest__.py) from the user's workspace. - Boundary markers: The instructions define structured output formats (Mermaid diagrams, Markdown headers) but do not explicitly define delimiters for input data.
- Capability inventory: File reading and text analysis only. No subprocess execution, file writing, or network capabilities are defined in the skill.
- Sanitization: None. The agent relies on its internal safety filters when processing workspace content.
Audit Metadata