odoo-upgrade

Pass

Audited by Gen Agent Trust Hub on Mar 25, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/test_upgrade.py uses os.system to execute other internal scripts (odoo19_precheck.py and upgrade_to_odoo19.py) during its test routine. This is a functional use of command execution to verify the toolset within a controlled testing environment.
  • [EXTERNAL_DOWNLOADS]: The skill's documentation and manifest update scripts reference several well-known and legitimate Python dependencies required for Odoo development, such as lxml, psycopg2, geopy, and openupgradelib. These are standard packages in the Odoo ecosystem.
  • [PROMPT_INJECTION]: The skill processes user-provided Odoo module files (Python, XML, JS). This creates a surface for indirect prompt injection if a processed file contains malicious instructions intended to influence the AI agent's behavior. While the skill does not implement explicit boundary markers or data sanitization, this is typical for development-oriented tools and is noted as a best-practice observation.
  • [DATA_EXPOSURE]: The tools perform file system operations including reading, writing, and creating backups of Odoo module files. These actions are limited to the project directory provided by the user and are necessary for the skill's stated purpose of upgrading code.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 25, 2026, 06:27 AM