Odoo Assistant Store Manager

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:44 AM UTC
• Version: 1.0.1

Overview

This Odoo management skill is mostly coherent, but its optional chat listener can make real ERP changes from broad Discuss messages without clear authorization or confirmation safeguards.

Install only for a tightly controlled Odoo account and test database unless you first add allowlisted channels/users, explicit confirmations for writes, restricted outbound URL fetching, HTML sanitization, and draft-only product import. Treat the Discuss listener as privileged automation, not a general chat bot.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: src/odoo_listener.py:220

Finding

Unauthorized Odoo Operations Through Unrestricted Discuss Channel Commands

Content

View full analysis

https?://\S+).*?a\s+(?P[\d.,]+).*?en\s+(?P.+)", clean_text, re.IGNORECASE | re.DOTALL ) if smart_match: logger.info("🧠 Comando SMART detectado") url = smart_match.group('url') url = url.split('"')[0].split('<')[0] price = smart_match.group('price').replace(',', '.') category = smart_match.group('category').strip() name, description = extract_metadata(url) qty = 0 qty_match = re.search( r"(?:con|x)\s*(?P\d+)\s*(?:u\.|unidades|stock|uds)?", clean_text, re.IGNORECASE ) if qty_match: qty = int(qty_match.group('qty')) manager_cmd = ( f"add_product --name {shlex.quote(name)} --price {price} --qty {qty} " f"--category {shlex.quote(category)} --image-url {shlex.quote(img_url)} " f"--extra-images {shlex.quote(extra_images_str)} " f"--description {shlex.quote(description)}" ) response_text = run_manager_tool(manager_cmd) keywords_found = True ``` It also permits stock modification: ```python stock_match = re.search( r"(?:ajusta|pon|cambia|actualiza)\s+stock\s+(?:de\s+)?(?P.+?)\s+a\s+(?P\d+)", clean_text, re.IGNORECASE ) if stock_match and not keywords_found: ref = stock_match.group('ref').strip() qty = stock_match.group('qty') cmd = f"update_stock --ref {shlex ...[truncated 2282 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: src/odoo_listener.py:85

Finding

Server-Side Request Forgery Through User-Controlled Product and Image URLs

Content

View full analysis

5120: # 5MB logger.warning(f"Imagen muy grande ({size_kb:.0f}KB), puede tardar en cargar") # Codificar a base64 encoded = base64.b64encode(image_data).decode('utf-8') return encoded ``` The URL comes from channel content: ```python smart_match = re.search( r"añade\s+(?Phttps?://\S+).*?a\s+(?P[\d.,]+).*?en\s+(?P.+)", clean_text, re.IGNORECASE | re.DOTALL ) if smart_match: url = smart_match.group('url') name, description = extract_metadata(url) ``` ### Technical Analysis The application accepts attacker-controlled HTTP or HTTPS URLs and requests them from the machine running the listener. There is no destination allowlist, hostname normalization, resolved-IP validation, private-address rejection, redirect validation, or DNS-rebinding protection. ...[truncated 2138 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: src/odoo_listener.py:173

Finding

Excessive Global Odoo Message Collection and Sensitive Message Logging

Content

View full analysis

', last_processed_id], ['message_type', '=', 'comment'], ['author_id', '!=', bot_partner_id] ] msg_ids = models.execute_kw(DB, uid, PASS, 'mail.message', 'search', [domain], {'order': 'id asc', 'limit': 10}) if msg_ids: messages = models.execute_kw(DB, uid, PASS, 'mail.message', 'read', [msg_ids], {'fields': [ 'body', 'author_id', 'res_id', 'model', 'date', 'partner_ids', 'message_type' ]}) ``` Relevant message content is logged in plaintext: ```python logger.info(f"📩 Mensaje Potencial de {author_name}: {clean_text}") ``` ### Technical Analysis The listener retrieves all new `mail.message` comments visible to the configured account and only filters their relevance after the message bodies have already been transferred to and processed by the local process. The query is not restricted to approved Discuss channels, direct messages addressed to the bot, or a dedicated model and record set. Odoo chatter can contain customer information, order discussions, internal operational notes, support content, and other confidential business data. If the configured account has broad access, the listener unnecessarily reads content outside its declared need to handle bot conversations. For messages treated as potentially relevant, the complete c ...[truncated 1480 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: src/odoo_listener.py:94

Finding

Untrusted Scraped HTML Published in Odoo Product Descriptions

Content

View full analysis

(.*?)', r'\1', clean_desc, flags=re.IGNORECASE | re.DOTALL ) clean_desc = re.sub( r'

(.*?)

', r'\1', clean_desc, flags=re.IGNORECASE | re.DOTALL ) if len(clean_desc) > 50: description = clean_desc break ``` The extracted description is passed to the manager: ```python name, description = extract_metadata(url) manager_cmd = ( f"add_product --name {shlex.quote(name)} --price {price} --qty {qty} " f"--category {shlex.quote(category)} --image-url {shlex.quote(img_url)} " f"--extra-images {shlex.quote(extra_images_str)} " f"--description {shlex.quote(description)}" ) response_text = run_manager_tool(manager_cmd) ``` The manager inserts the untrusted HTML into a product description: ```python web_html = f"""

{description}

...[truncated 3257 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (29)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented description understates the actual behavior by omitting access to detailed customer order data, event registration records, and fetching arbitrary external image URLs. This is dangerous because it hides sensitive data access and introduces an SSRF/data-exfiltration style risk surface through remote URL fetching, preventing informed consent and accurate security review.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md

Use the terminal to run `src/odoo_manager.py` from the **skill root** (the directory that contains this file).

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

Use the terminal to run `src/odoo_manager.py` from the **skill root** (the directory that contains this file).

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

Use the terminal to run `src/odoo_manager.py` from the **skill root** (the directory that contains this file).

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md

Use the terminal to run `src/odoo_manager.py` from the **skill root** (the directory that contains this file).

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md

Use the terminal to run `src/odoo_manager.py` from the **skill root** (the directory that contains this file).

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

Use the terminal to run `src/odoo_manager.py` from the **skill root** (the directory that contains this file).

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md

Use the terminal to run `src/odoo_manager.py` from the **skill root** (the directory that contains this file).

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md

Use the terminal to run `src/odoo_manager.py` from the **skill root** (the directory that contains this file).

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md

Use the terminal to run `src/odoo_manager.py` from the **skill root** (the directory that contains this file).

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md

Use the terminal to run `src/odoo_manager.py` from the **skill root** (the directory that contains this file).

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md

Use the terminal to run `src/odoo_manager.py` from the **skill root** (the directory that contains this file).

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file is written entirely in Spanish, including operational and safety instructions, with no indication that the user can choose another language or that the locale restriction is intentional. Under the policy rule, forcing a specific language without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill exposes capabilities to access environment variables, the network, and the shell, but the manifest text shown here does not declare any explicit tool scope or permission boundaries. That creates a real least-privilege and review problem: an agent or user may trust the documented behavior while the implementation can still execute broader actions, including using credentials from the environment and making external requests.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The Discuss listener executes a local management CLI based on parsed message content, creating a chat-triggered execution bridge into administrative functionality. Even though direct shell injection appears mitigated, this is still a real security issue because untrusted chat input can invoke privileged local operations, expanding the attack surface and coupling messaging access to backend command execution.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · src/odoo_listener.py (reported line 62)May include surrounding context.

python

logger.debug(f"⚙️ Ejecutando: {' '.join(cmd)}")
        
        # Ejecutamos y capturamos el output con timeout de 30s
        result = subprocess.check_output(cmd, stderr=subprocess.STDOUT, timeout=30)
        output = result.decode('utf-8')
        
        elapsed = time.time() - start_time

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The listener fetches arbitrary URLs supplied through chat commands and downloads their contents server-side. This creates an SSRF-style primitive in which attackers can induce outbound requests from the host to internal services, cloud metadata endpoints, or otherwise restricted network locations, and the skill context makes this more dangerous because the requests are performed automatically as part of a privileged ERP workflow.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The Discuss listener is not merely informational: it can create products and modify stock directly from chat messages. In an ERP context, this is dangerous because any user who can message the bot in a DM or channel may be able to trigger inventory and catalog changes without approval, creating a powerful chat-to-admin control path that can be abused or triggered accidentally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill performs outbound network access to attacker-controlled or arbitrary third-party URLs based on chat input without any visible warning or confirmation. In practice this increases the risk of covert data egress, SSRF abuse, and privacy surprises for operators who may believe the listener only processes internal Odoo messages.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The bot can create or modify products from a natural-language chat command with no explicit confirmation step. In an ERP environment, accidental phrasing, spoofed requests, or misuse by an authorized-but-untrusted user can corrupt product data, create fraudulent catalog entries, or cause downstream operational and financial impact.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The listener updates stock quantities directly from chat commands without verification or confirmation. Because inventory levels drive sales availability, fulfillment, and purchasing decisions, unauthorized or mistaken stock changes can cause significant operational disruption and financial loss.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The function downloads arbitrary URLs supplied as product image sources, which creates a server-side request forgery surface and allows outbound connections to attacker-chosen hosts. Even with TLS defaults and a timeout, this can be abused to probe internal services, access cloud metadata endpoints, or force retrieval of untrusted large content from within the agent's network context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The manifest mentions products, but this code automatically sets website_published, description_ecommerce, public_categ_ids, and available_in_pos, coupling product creation with live ecommerce/POS publication behavior. That is broader than plain product management and should be explicitly declared if intended.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code retrieves and returns detailed customer shipping and contact data from orders, including street address, postal code, city, state, country, phone, and mobile. This is sensitive personal data access not disclosed by the manifest, creating a meaningful privacy and data-minimization risk if the skill is invoked by broader agents, logs, or unauthorized operators.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill exposes event-registration access even though the declared capability is limited to sales, web orders, stock, and products. This is a scope-expansion issue: an agent or user granted this skill may obtain attendee counts for events without that access being clearly disclosed or expected, undermining least-privilege and transparent consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.