Security audit

odoo-connector

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate Odoo connector, but it grants broad ERP data authority and has weak guardrails around credentials, HTTP transport, bulk imports, admin use, and optional CAPTCHA browser automation.

Use this only with Odoo instances you own or are explicitly authorized to administer. Before installing, plan for a least-privilege service account, API keys rather than passwords, HTTPS-only endpoints, staging tests, and explicit review before any create, write, unlink, bulk import, order confirmation, replenishment, or external sync. Do not use admin credentials in automated workflows, and review the optional CAPTCHA browser skill separately before trusting it during authenticated sessions.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:9
Finding: Unaudited External Skill Recommended for Authenticated CAPTCHA Handling
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Note

Location: SKILL.md:807
Finding: Skill References Root-Owned Agent Memory Outside the Project Boundary
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/bulk-import.py:145
Finding: Odoo Credentials Can Be Sent Through Plaintext HTTP
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: docs/troubleshooting.md:264
Finding: Troubleshooting Guidance Encourages Use of Administrator Credentials
Content: View full analysis
**Can't find the API Keys section?** Make sure you're logged in as an administrator. In some Odoo versions, you may need to enable Developer Mode first: go to **Settings → scroll to bottom → click "Activate the developer mode"**. ``` ```markdown 4. Test with admin credentials to rule out permission issues ``` ### Technical Analysis The documentation recommends administrator credentials as a troubleshooting mechanism. This conflicts with the Skill's own least-privilege guidance and unnecessarily raises the consequence of transport compromise, configuration mistakes, malicious CSV input, or unintended XML-RPC operations. The bundled importer accepts an arbitrary model name and creates records using the authenticated account. The broader Skill documentation also supports writes, deletes, and model-specific workflow methods. Running these capabilities with an administrator account can turn an otherwise limited error into a system-wide data integrity or confidentiality event. Using an administrator interactively to create an API key may sometimes be necessary for account administration, but routine connector diagnosis does not require giving the integration or test scripts administrator credentials. ### Attack Path 1. A normal service account receives an access error. 2. Following the troubleshooting instructions, the operator configures the scripts with administrator credentials or an administrator API key. 3. The scripts authenticate with unrestricted or broadly privileged access. 4. A mistaken model name, incorrect target environment, untrusted CSV file, intercepted credential, or unintended Agent-generated action is processed under administrator authority. 5. Records across sensitive Odoo model ...[truncated 564 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (25)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.
over HTTPS through standard reverse proxies (Traefik, nginx)

Why XML-RPC

Odoo provides multiple API access methods:

REST API: Limited, mostly for external integrations

JSON-RPC: Browser-oriented, requires session management

XML-RPC: Full programmatic access, stateless, language-agnostic

XML-RPC is the most reliable for AI agent automation because it's stateless (no session cookies), supports all operations, and works with any programming language that has XML-RPC client support.

⚡ FIRST TIME? START HERE — Authentication Setup

🔴 CRITICAL: You CANNOT use XML-RPC without valid API credentials. Before writing ANY code, make sure you have an API key. If you don't, follow the steps below FIRST.

Decision Flow

text
Do you have Odoo API credentials (API key)? ├── YES → Skip to "Connection Setup" section below └── NO → Follow Step 1 & Step 2 below, THEN continue

Step 1: Login to Odoo Web UI

Open a browser and navigate

Instruction Override

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.
md
7. **⚠️ CRITICAL: Copy the API key IMMEDIATELY — it's shown ONLY ONCE.** After you close the dialog, it cannot be retrieved again. 8. Store it securely (environment variable, password manager, `.env` file) > **Can't find the API Keys section?** Make sure you're logged in as an administrator. In some Odoo versions, you may need to enable Developer Mode first: go to **Settings → scroll to bottom → click "Activate the developer mode"**. ### Step 3: Verify Credentials Work

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The unlink example performs irreversible deletion of a remote Odoo record without a strong warning about destructive impact. In an Odoo connector quickstart, users may execute the snippet against production-like environments, potentially deleting real records and causing data loss or breaking linked business processes and audit trails.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The changelog explicitly adds anti-detection browser guidance and CAPTCHA/Cloudflare bypass troubleshooting for logging into Odoo web UIs, which is outside the stated XML-RPC integration scope. Even though framed as troubleshooting, this materially enables evasion of access controls and bot-detection systems, increasing the risk that downstream agents use the skill for unauthorized automation against protected instances.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The markdown description advertises authentication and CRUD operations, including unlink, but does not include any caution that these actions can modify or permanently delete records in the connected Odoo instance. For a skill that can affect business data and system integrity, users should be explicitly warned in the documentation.
Content: No source excerpt is available for this finding.

Behavior Manipulation

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Subtle instructions detected that may alter agent decision-making or introduce hidden biases.
Content: Scanner excerpt · SECURITY.md (reported line 48)May include surrounding context.
md
### API Keys Over Passwords Always prefer Odoo API keys over user passwords: - API keys can be revoked individually without affecting the user account - API keys can be scoped to specific operations

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 82% confidence
Finding: The skill provides operational guidance that encourages use of environment variables, local files such as .env, and an internal memory path, but it does not declare any explicit tool scope or permissions boundaries. In an agent setting, this mismatch can lead to overbroad access to local secrets or files during execution, especially when the skill asks the agent to retrieve credentials or read internal notes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The core API example explicitly includes password as a password or API key parameter, but the surrounding documentation does not warn users to protect credentials or avoid exposing secrets in logs, scripts, or shared snippets. In markdown documentation, omission of warnings about handling credentials is a privacy and security concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file documents create, write, and especially unlink as universal methods, but it does not include any warning that these operations can modify or permanently delete business records. Because the file is user-facing reference material, omitting a caution about data-changing and deletion behavior can lead to unsafe use affecting user data and system integrity.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The sales order methods include actions such as confirm, cancel, reset, and mark done, which can materially affect transactional records and downstream business processes. The documentation presents these actions as routine methods but does not warn that they may trigger significant state changes and should be used with care.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The many2many/one2many command reference includes destructive commands such as (2, id, 0) to delete related records, (5, 0, 0) to unlink all, and (6, 0, [ids]) to replace all relations. The documentation does not warn users that these commands can remove data or overwrite existing relationships.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · docs/installation.md (reported line 34)May include surrounding context.
You can quickly test if XML-RPC is available on your Odoo instance by running:

bash
curl -s https://your-odoo-instance.com/xmlrpc/2/common -d '<?xml version="1.0"?><methodCall><methodName>version</methodName></methodCall>'

If you receive an XML response with version information, XML-RPC is working correctly.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The quickstart includes a live create operation against Odoo without clearly warning that it will modify remote production data if run as-is. In an integration skill, users often copy-paste examples directly, so this can cause unintended record creation in real environments, polluting customer data or triggering downstream business workflows.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The write example updates an existing remote partner record but does not warn that it changes live data on the connected Odoo instance. In this skill context, the danger is elevated because the document is a quickstart and encourages direct execution, increasing the chance of accidental modification of business records.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · docs/troubleshooting.md (reported line 54)May include surrounding context.
md
2. **Wrong URL** — Verify the URL includes the protocol (`https://`) and correct port. Default Odoo port is 8069 (HTTP) or 443 (HTTPS through reverse proxy). 3. **Firewall blocking** — Check firewall rules: `sudo ufw status` or `iptables -L`. Ensure port 8069/443 is open. 4. **DNS resolution failure** — If using a domain name, verify DNS: `dig your-odoo-domain.com`.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The troubleshooting guide recommends testing with admin credentials to isolate permission issues, but it does so without a clear warning about least-privilege and without constraining that advice to temporary, controlled diagnostics. In an agent skill for an Odoo connector, this can normalize use of highly privileged credentials and lead operators to run integrations with administrator access, increasing blast radius if the agent is misused or compromised.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The example encourages automatic execution of action_replenishment against a live Odoo instance without an explicit warning that it can trigger real business-side effects such as procurement or stock workflows. In an agent skill context, users may copy or automate the snippet directly, increasing the chance of unintended inventory-affecting actions in production.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The e-commerce sync example exports product identifiers and inventory quantities to an external platform without any notice about data sharing, privacy, tenancy boundaries, or contractual controls. While inventory data is not always highly sensitive, in many environments SKU mappings, stock levels, and catalog details are commercially sensitive and should not be transmitted blindly by an agent workflow.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The example performs sale.order.action_confirm directly, which changes business state and may trigger downstream operational effects such as fulfillment, invoicing workflows, stock reservations, or audit-impacting records. In an agent skill context, examples are often copied verbatim into automation, so omitting a prominent warning or safety gate increases the chance of unintended irreversible or costly actions in production.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest describes an AI agent skill for Odoo XML-RPC authentication, CRUD, and search operations, but this file is a standalone bulk-import utility whose documented purpose is to import CSV data into any Odoo model. That behavior is materially different from the declared skill-level scope because it introduces broad mass-write capability rather than a bounded agent integration interface.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The user-controlled --model parameter allows bulk creation in any model accessible to the supplied Odoo account, including sensitive business objects, making accidental or abusive mass modification easier. In an agent skill context, this is more dangerous because a higher-level agent or operator may pass an unsafe model name without realizing the breadth of impact, and the script adds no local guardrails beyond Odoo's remote permissions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script proceeds directly from validation to irreversible record creation without an interactive confirmation, approval flag, or safety interlock. In a bulk import tool used by an AI agent or automation pipeline, this increases the likelihood of large-scale accidental data corruption, duplicate creation, or unintended writes caused by bad input, prompt mistakes, or operator error.
Content: No source excerpt is available for this finding.

Scope Creep

Low

Category: Excessive Agency
Confidence: 70% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · LICENSE (reported line 12)May include surrounding context.
text
permit persons to whom the Software is furnished to do so. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The comment at L190 says "Create an inventory adjustment (Odoo 17+)" but the code at L195-L198 calls product.product.action_replenishment, which triggers replenishment behavior rather than creating an inventory adjustment record. This is an active contradiction in the inline documentation about what the code does.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The explanatory text states that a customer_rank > 0 check confirms the record is flagged as a customer. However, the actual query at L43-L47 filters only on email and merely reads customer_rank as a returned field, so the described validation does not occur.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T08 · Insecure Dependencies

T05 · Unauthorized Access and Privilege Escalation

T09 · Insecure Skill Coding Practices

T05 · Unauthorized Access and Privilege Escalation

SkillSpector

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

Why XML-RPC

⚡ FIRST TIME? START HERE — Authentication Setup

Decision Flow

Step 1: Login to Odoo Web UI

Instruction Override

Missing User Warnings

Context-Inappropriate Capability

Missing User Warnings

Behavior Manipulation

Undeclared Tool Scope

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

External Transmission

Missing User Warnings

Missing User Warnings

Sudo/Root Execution

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Description-Behavior Mismatch

Context-Inappropriate Capability

Missing User Warnings

Scope Creep

Intent-Code Divergence

Intent-Code Divergence

Static analysis