ClawHub
Back to skill

Security audit

Odoo Reporting

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-aligned rather than malicious, but it needs review because it handles sensitive Odoo financial credentials with broad read access and weak TLS/dependency safeguards.

Install only with a dedicated read-only Odoo user or API key, require an https:// Odoo URL, do not use --insecure in production, keep .env out of shared repositories with restrictive permissions, and treat rpc-call as broad read access to whatever that Odoo account can see.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
assets/autonomous-cfo/src/connectors/odoo_client.py:193
Finding

Odoo credentials may be transmitted without authenticated TLS

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
assets/autonomous-cfo/requirements.txt:1
Finding

Dependency installation is not reproducible or integrity-locked

Content
View full analysis
=2.31.0,<3.0.0 matplotlib>=3.8.0,<4.0.0 pillow>=10.0.0,<12.0.0 fpdf2>=2.8.0,<3.0.0 openpyxl>=3.1.0,<4.0.0 pytest>=8.0.0,<9.0.0 ``` ### Technical Analysis The installer upgrades pip dynamically and installs dependencies from broad version ranges. No lock file, exact transitive dependency set, package hashes, or restricted package index is provided. Consequently, two installations performed at different times may retrieve and execute different artifacts. Python package installation can execute package build backends and installation-related code. If a permitted future version, transitive dependency, package-index account, or distribution artifact is compromised, malicious code could run under the account installing the Skill. The production requirements also include `pytest`, even though it is only needed for development and testing. This unnecessarily increases the number of packages and transitive dependencies present in the runtime environment. No dependency in the reviewed artifact was proven malicious. This finding concerns avoidable supply-chain exposure and lack of reproducible integrity verification. ### Attack Path 1. The user runs `assets/autonomous-cfo/install.sh`. 2. The script upgrades pip to the latest available compatible release and ...[truncated 1049 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (68)

Tainted flow: 'url' from os.getenv (line 172, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · assets/autonomous-cfo/src/connectors/odoo_client.py (reported line 240)May include surrounding context.

python
for _ in range(attempts):
            try:
                resp = requests.post(
                    url=url,
                    headers=self._headers(),
                    json=payload,

Tainted flow: 'url' from os.getenv (line 47, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · assets/autonomous-cfo/src/tools/cfo_cli.py (reported line 52)May include surrounding context.

python
return "xmlrpc"

    try:
        resp = requests.get(f"{url}/web/version", timeout=min(args.timeout, 10), verify=not args.insecure)
        resp.raise_for_status()
        payload = resp.json() if resp.text else {}
        version = str(payload.get("version", ""))

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

Exposing or enabling arbitrary raw Odoo RPC/model method execution is materially broader than a read/query reporting skill and can become dangerous even with nominal read-only intentions. If runtime controls are weak or bypassed, this could permit access to unintended models, metadata discovery, or even state-changing operations against the ERP system.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Exposing or enabling arbitrary raw Odoo RPC/model method execution is materially broader than a read/query reporting skill and can become dangerous even with nominal read-only intentions. If runtime controls are weak or bypassed, this could permit access to unintended models, metadata discovery, or even state-changing operations against the ERP system.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Exposing or enabling arbitrary raw Odoo RPC/model method execution is materially broader than a read/query reporting skill and can become dangerous even with nominal read-only intentions. If runtime controls are weak or bypassed, this could permit access to unintended models, metadata discovery, or even state-changing operations against the ERP system.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

Exposing or enabling arbitrary raw Odoo RPC/model method execution is materially broader than a read/query reporting skill and can become dangerous even with nominal read-only intentions. If runtime controls are weak or bypassed, this could permit access to unintended models, metadata discovery, or even state-changing operations against the ERP system.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

Exposing or enabling arbitrary raw Odoo RPC/model method execution is materially broader than a read/query reporting skill and can become dangerous even with nominal read-only intentions. If runtime controls are weak or bypassed, this could permit access to unintended models, metadata discovery, or even state-changing operations against the ERP system.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Exposing or enabling arbitrary raw Odoo RPC/model method execution is materially broader than a read/query reporting skill and can become dangerous even with nominal read-only intentions. If runtime controls are weak or bypassed, this could permit access to unintended models, metadata discovery, or even state-changing operations against the ERP system.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

Exposing or enabling arbitrary raw Odoo RPC/model method execution is materially broader than a read/query reporting skill and can become dangerous even with nominal read-only intentions. If runtime controls are weak or bypassed, this could permit access to unintended models, metadata discovery, or even state-changing operations against the ERP system.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Exposing or enabling arbitrary raw Odoo RPC/model method execution is materially broader than a read/query reporting skill and can become dangerous even with nominal read-only intentions. If runtime controls are weak or bypassed, this could permit access to unintended models, metadata discovery, or even state-changing operations against the ERP system.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Exposing or enabling arbitrary raw Odoo RPC/model method execution is materially broader than a read/query reporting skill and can become dangerous even with nominal read-only intentions. If runtime controls are weak or bypassed, this could permit access to unintended models, metadata discovery, or even state-changing operations against the ERP system.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

Exposing or enabling arbitrary raw Odoo RPC/model method execution is materially broader than a read/query reporting skill and can become dangerous even with nominal read-only intentions. If runtime controls are weak or bypassed, this could permit access to unintended models, metadata discovery, or even state-changing operations against the ERP system.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

Exposing or enabling arbitrary raw Odoo RPC/model method execution is materially broader than a read/query reporting skill and can become dangerous even with nominal read-only intentions. If runtime controls are weak or bypassed, this could permit access to unintended models, metadata discovery, or even state-changing operations against the ERP system.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

Exposing or enabling arbitrary raw Odoo RPC/model method execution is materially broader than a read/query reporting skill and can become dangerous even with nominal read-only intentions. If runtime controls are weak or bypassed, this could permit access to unintended models, metadata discovery, or even state-changing operations against the ERP system.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Exposing or enabling arbitrary raw Odoo RPC/model method execution is materially broader than a read/query reporting skill and can become dangerous even with nominal read-only intentions. If runtime controls are weak or bypassed, this could permit access to unintended models, metadata discovery, or even state-changing operations against the ERP system.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Exposing or enabling arbitrary raw Odoo RPC/model method execution is materially broader than a read/query reporting skill and can become dangerous even with nominal read-only intentions. If runtime controls are weak or bypassed, this could permit access to unintended models, metadata discovery, or even state-changing operations against the ERP system.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
94% confidence
Finding

The skill explicitly depends on credentials stored in a local .env file and instructs users to create and edit that file. Storing sensitive ERP credentials in a plaintext local file materially increases the risk of accidental disclosure through backups, repo inclusion, permissive filesystem access, or other tools reading workspace files.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

Setup:

bash
cd skills/odoo/assets/autonomous-cfo
cp .env.example .env
# Edit .env with your actual credentials
nano .env

Credential Access

High
Category
Privilege Escalation
Confidence
94% confidence
Finding

Repeating the instruction to copy a template into a live .env file reinforces a credential-handling pattern that relies on plaintext secrets near executable code. For an Odoo skill with network access, compromise of these credentials can expose sensitive accounting, customer, invoice, and operational data.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

bash
cd skills/odoo/assets/autonomous-cfo
cp .env.example .env
# Edit .env with your actual credentials
nano .env

Credential Access

High
Category
Privilege Escalation
Confidence
94% confidence
Finding

The instruction to edit the .env manually shows that the workflow expects human-managed plaintext secrets, which are easy to mishandle and difficult to audit. Because the skill accesses an ERP system, leaked credentials could enable broad business-data exposure and potentially state changes if the account is not truly read-only.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

cd skills/odoo/assets/autonomous-cfo cp .env.example .env

Edit .env with your actual credentials

nano .env

text

### API Key vs Password

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · assets/autonomous-cfo/install.sh (reported line 26)May include surrounding context.

sh
./venv/bin/python -c "import requests, matplotlib, PIL, fpdf; print('All dependencies installed')"

# Test connection (requires .env)
if [ -f ".env" ]; then
    echo "Testing Odoo connection..."
    ./venv/bin/python src/tools/cfo_cli.py doctor
else

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · assets/autonomous-cfo/src/connectors/odoo_client.py (reported line 524)May include surrounding context.

python
./venv/bin/python -c "import requests, matplotlib, PIL, fpdf; print('All dependencies installed')"

# Test connection (requires .env)
if [ -f ".env" ]; then
    echo "Testing Odoo connection..."
    ./venv/bin/python src/tools/cfo_cli.py doctor
else

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · assets/autonomous-cfo/src/tools/cfo_cli.py (reported line 65)May include surrounding context.

python
./venv/bin/python -c "import requests, matplotlib, PIL, fpdf; print('All dependencies installed')"

# Test connection (requires .env)
if [ -f ".env" ]; then
    echo "Testing Odoo connection..."
    ./venv/bin/python src/tools/cfo_cli.py doctor
else

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · assets/autonomous-cfo/tests/test_skill.py (reported line 204)May include surrounding context.

python
./venv/bin/python -c "import requests, matplotlib, PIL, fpdf; print('All dependencies installed')"

# Test connection (requires .env)
if [ -f ".env" ]; then
    echo "Testing Odoo connection..."
    ./venv/bin/python src/tools/cfo_cli.py doctor
else

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.json (reported line 73)May include surrounding context.

json
./venv/bin/python -c "import requests, matplotlib, PIL, fpdf; print('All dependencies installed')"

# Test connection (requires .env)
if [ -f ".env" ]; then
    echo "Testing Odoo connection..."
    ./venv/bin/python src/tools/cfo_cli.py doctor
else

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.json (reported line 94)May include surrounding context.

json
./venv/bin/python -c "import requests, matplotlib, PIL, fpdf; print('All dependencies installed')"

# Test connection (requires .env)
if [ -f ".env" ]; then
    echo "Testing Odoo connection..."
    ./venv/bin/python src/tools/cfo_cli.py doctor
else

Static analysis

No suspicious patterns detected.