Security audit

odoo-connector

Security checks for vulnerabilities and agentic risk

Overview

This is a legitimate Odoo connector, but it can make real changes to live ERP data when used with write-capable credentials.

Install only if you intend to let an agent work with an Odoo instance you control. Use a dedicated least-privilege API user, test against staging first, keep delete and state-changing methods disabled unless needed, and require explicit confirmation before bulk import, unlink, action_confirm, replenishment, or third-party sync operations.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 82% confidence
Finding: The skill instructs agents to read local documentation files and explicitly references an internal workspace path, but it declares no permissions for file access or environment access despite also recommending environment-variable credential storage. This mismatch can cause agents or platforms to grant broader implicit capabilities than users expect, increasing the chance of unintended local file or secret access.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The stated purpose is limited to authentication, CRUD, and search, but the repository structure and examples indicate bulk import and batch creation capabilities against arbitrary Odoo models. Understating write-heavy and mass-change functionality is dangerous because users may invoke the skill assuming low-risk integration behavior when it can actually perform large-scale modifications to production ERP data.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill documents direct use of Odoo's unlink operation but does not require irreversibility warnings, pre-deletion validation, or a confirmation step before destructive execution. In an ERP context, deleting records can break referential integrity, remove audit-relevant business data, and trigger operational impact if an agent acts on the wrong environment or IDs.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The quickstart includes `create`, `write`, and `unlink` examples that directly modify and delete records, but it does not prominently warn users that these commands act on the target Odoo instance and may affect live business data. In a setup guide, readers often copy-paste commands verbatim, so omission of a safety warning increases the risk of accidental data corruption or deletion in production environments.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The guide recommends testing with admin credentials to troubleshoot permission issues, but it does not warn that highly privileged accounts should not be used for routine integrations or broad API testing. In the context of an Odoo XML-RPC connector, normalizing admin use increases the chance of over-privileged deployments, accidental destructive changes, and credential exposure if those credentials are reused or logged.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The example encourages automatic creation of replenishment actions in Odoo without an explicit warning that this changes business/procurement state. In an agent skill context, users may copy or automate the snippet and unintentionally trigger stock planning or purchasing workflows, causing unauthorized operational changes or downstream financial impact.

Missing User Warnings

Low

Confidence: 78% confidence
Finding: The CSV export example writes product and inventory data to a local file without warning that potentially sensitive business data is being persisted outside Odoo. In shared hosts, developer workstations, or automated agent environments, this can lead to unintended disclosure through weak filesystem permissions, backups, or log/artifact collection.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The example suggests sending stock levels to an external e-commerce platform without warning that internal business data is being transmitted to a third party. In an integration skill, this increases risk of unintended data sharing, compliance issues, or propagation of incorrect inventory if the destination, authorization, or data-mapping is not carefully controlled.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The example performs `action_confirm` on a sales order through the API and presents it as a normal workflow without an explicit warning that confirmation changes business state and may trigger downstream fulfillment, invoicing, procurement, or audit-relevant actions. In an agent skill context, runnable examples are likely to be copied into automation, so omitting a cautionary boundary increases the risk of unintended real-world transactions.

Static analysis

No suspicious patterns detected.