odoo-upgrade
Pass
Audited by Gen Agent Trust Hub on Mar 25, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/test_upgrade.pyusesos.systemto execute other internal scripts (odoo19_precheck.pyandupgrade_to_odoo19.py) during its test routine. This is a functional use of command execution to verify the toolset within a controlled testing environment. - [EXTERNAL_DOWNLOADS]: The skill's documentation and manifest update scripts reference several well-known and legitimate Python dependencies required for Odoo development, such as
lxml,psycopg2,geopy, andopenupgradelib. These are standard packages in the Odoo ecosystem. - [PROMPT_INJECTION]: The skill processes user-provided Odoo module files (Python, XML, JS). This creates a surface for indirect prompt injection if a processed file contains malicious instructions intended to influence the AI agent's behavior. While the skill does not implement explicit boundary markers or data sanitization, this is typical for development-oriented tools and is noted as a best-practice observation.
- [DATA_EXPOSURE]: The tools perform file system operations including reading, writing, and creating backups of Odoo module files. These actions are limited to the project directory provided by the user and are necessary for the skill's stated purpose of upgrading code.
Audit Metadata