odoo-commit
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute standard git commands (git status, git diff, git log, git add, git commit, git rebase) to manage the local repository and stage changes according to the Odoo workflow.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local git diffs and logs to summarize changes, which introduces a surface for indirect prompt injection if the repository content is malicious.
- Ingestion points: The workflow processes output from git diff --stat and git log -1 --oneline (SKILL.md Step 1).
- Boundary markers: No specific delimiters or safety instructions are defined to separate the ingested git output from the agent's logic.
- Capability inventory: The skill possesses the capability to write local files (cat > /tmp/...) and modify the git repository state (git add, git commit, git rebase) as described in Workflow Steps 2 through 5.
- Sanitization: The skill does not include specific sanitization or filtering steps for the ingested diff data before using it to generate commit messages.
Audit Metadata