T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/custom_app.py:116- Finding
Blocked Odoo Models Are Accessible Through Direct XML-RPC Calls
- Content
View full analysis
- Remediation
View remediation
Security audit
VNClaw Odoo Skill
Security checks for vulnerabilities and agentic risk
Overview
This is a real Odoo integration, but it can make broad, immediate changes across an ERP system with weak scoping and transport safeguards.
Install only after review. Use a least-privileged Odoo account, require HTTPS in ODOO_URL, avoid admin credentials, and be especially careful with custom_app.py or odoo_core.py because they can read or modify many Odoo models. Review write, bulk update, note, notification, timesheet, calendar, and leave actions before execution.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/odoo_core.py:230- Finding
Note and Activity Helpers Bypass Central Operation and Model Validation
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/odoo_core.py:47- Finding
Odoo Credentials and Business Data Can Be Transmitted over Plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:10- Finding
Mandatory Immediate Execution Removes Safety Confirmation for State-Changing Operations
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (46)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The documented behavior includes direct access to arbitrary Odoo models and lower-level primitives such as field introspection and record counting that are not reflected in the stated purpose. That creates a deceptive trust boundary: a reviewer may approve a task/project helper while the skill can inspect other applications and identities such as users, employees, partners, and metadata models.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The documented behavior includes direct access to arbitrary Odoo models and lower-level primitives such as field introspection and record counting that are not reflected in the stated purpose. That creates a deceptive trust boundary: a reviewer may approve a task/project helper while the skill can inspect other applications and identities such as users, employees, partners, and metadata models.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The documented behavior includes direct access to arbitrary Odoo models and lower-level primitives such as field introspection and record counting that are not reflected in the stated purpose. That creates a deceptive trust boundary: a reviewer may approve a task/project helper while the skill can inspect other applications and identities such as users, employees, partners, and metadata models.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The documented behavior includes direct access to arbitrary Odoo models and lower-level primitives such as field introspection and record counting that are not reflected in the stated purpose. That creates a deceptive trust boundary: a reviewer may approve a task/project helper while the skill can inspect other applications and identities such as users, employees, partners, and metadata models.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly instructs the agent to perform commands immediately and forbids asking for user confirmation, even for create and update actions that modify Odoo records. This is dangerous because natural-language ambiguity, prompt injection, or mis-parsing can result in unintended state changes to business systems without a human checkpoint.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest frames the skill as limited to specific Odoo areas, yet the documentation exposes generic access to arbitrary models and custom apps. This significantly broadens the data and action surface beyond user expectations, enabling access to records and schemas across the ERP if the connected account has privileges.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The Custom App section explicitly extends the skill to CRM, Sales, Purchase, Inventory, Manufacturing, Accounting, and any installed custom app, far beyond the manifest's listed modules. In practice, this turns a targeted business-object helper into a broad ERP client, increasing the chance of unauthorized data exposure or unintended writes in sensitive domains.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # VNClaw — Odoo 17 Environment Variables # Copy this file to .env and fill in your values. # NEVER commit the .env file to version control. # Base URL of your Odoo 17 instance (no trailing slash)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # VNClaw — Odoo 17 Environment Variables # Copy this file to .env and fill in your values. # NEVER commit the .env file to version control. # Base URL of your Odoo 17 instance (no trailing slash)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text # VNClaw — Odoo 17 Environment Variables # Copy this file to .env and fill in your values. # NEVER commit the .env file to version control. # Base URL of your Odoo 17 instance (no trailing slash)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text # VNClaw — Odoo 17 Environment Variables # Copy this file to .env and fill in your values. # NEVER commit the .env file to version control. # Base URL of your Odoo 17 instance (no trailing slash)
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The module explicitly provides a generic interface to any Odoo model/app, which materially exceeds the declared skill scope of a limited set of business domains. Even if odoo_core blocks deletes and some models, unrestricted cross-model read/create/update access can enable unauthorized access or modification of unrelated business data, configurations, or sensitive records if the connected Odoo account has broad permissions.
- Content
Scope Creep
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The --extra parameter is parsed as arbitrary JSON and merged directly into vals during create/update, allowing callers to set any writable Odoo field on project records, not just the intended safe subset. This bypasses the declared interface constraints and can enable unauthorized configuration changes, privacy changes, ownership reassignment, linkage to other records, or other business-logic abuse depending on server-side ACLs.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill declares no explicit tool scope despite clearly requiring environment variable access and network communication to an external Odoo instance. Without an allowlist such as permissions or allowed-tools, a host agent may grant broader execution capability than users expect, reducing containment for a skill that can read and modify business data.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md --- name: vnclaw-odoo-skill description: "Integrate with Odoo 17 via XML-RPC API. Use when: managing projects, tasks, calendar events, time off requests, helpdesk tickets, knowledge articles, documents, or timesheets in Odoo 17. Supports read, create, and update operations only. No delete allowed." argument-hint: "Describe what you want to do in Odoo 17 (e.g., 'list all open tasks in project X', 'create a time off request')" --- # VNClaw — Odoo 17 Integration Skill
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
The instruction to 'always run the command immediately' delegates operational decision-making to the agent without confirmation, increasing the risk of unsafe autonomous actions in an external business system. In a skill with write capabilities, autonomy materially raises the chance of unauthorized or erroneous modifications.
- Content
md ## Execution Rules (MUST follow) 1. **ALWAYS run the command immediately.** Never ask the user to confirm or explain what the command does before running it. Translate the request → pick the command → execute it in one step. 2. **Never say "Would you like me to execute this?"** — just execute it. 3. **Never ask "Do you want me to run this?"** — just run it. 4. **If the command fails**, show the error and try to fix it. Do not ask the user for help diagnosing unless you have exhausted all options.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md 1. **ALWAYS run the command immediately.** Never ask the user to confirm or explain what the command does before running it. Translate the request → pick the command → execute it in one step. 2. **Never say "Would you like me to execute this?"** — just execute it. 3. **Never ask "Do you want me to run this?"** — just run it. 4. **If the command fails**, show the error and try to fix it. Do not ask the user for help diagnosing unless you have exhausted all options. 5. **Credentials**: If env vars are missing, inform the user which variable is missing and stop. Do not ask for the value interactively. ## Path Resolution
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The low-level generic client enables raw model queries and field definition retrieval, which contradicts the limited-purpose framing of the skill. Even if intended for troubleshooting, this bypasses the safer abstractions of dedicated module scripts and can be used to enumerate or access broader Odoo data structures.
- Content
Scope Creep
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The create and update paths merge user-supplied JSON from --extra directly into the Odoo values dict without any allowlist or scope enforcement. That lets callers set arbitrary calendar.event fields beyond the skill's declared interface, potentially changing ownership, privacy, recurrence, links, reminders, or other sensitive properties and bypassing the intended operation limits of the skill.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The models command allows enumeration of installed Odoo models, including names and descriptions, beyond the stated end-user workflows. This kind of discovery expands attacker knowledge of the environment and makes it easier to identify sensitive modules, administrative objects, and high-value targets for subsequent reads or writes through the same generic interface.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The fields command exposes schema introspection for arbitrary models, revealing field names, types, relations, and other metadata. In combination with generic read/create/update operations, this lowers the barrier to exploiting overbroad access by helping a caller map sensitive structures and craft targeted queries or modifications against models outside the intended scope.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The create and update commands perform persistent remote writes via Odoo API calls (
createandwrite) that can alter user or business data. In this file there is no confirmation prompt, cautionary print/log message, or explanatory comment/docstring warning the user before or during these state-changing operations.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The create and update commands modify helpdesk tickets via backend write operations, but the code provides no confirmation prompt, no visible warning before the change, and no explanatory comment/docstring disclosing the side effect. Because these commands alter persistent business data, users are not explicitly warned in this file about the write action beyond terse command names.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The --extra parameter allows arbitrary JSON fields to be merged directly into the values sent to Odoo during create/update. This bypasses the narrow, documented field set and can enable modification of sensitive or workflow-controlling attributes not intended by the skill description, depending on server-side ACLs.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill manifest claims read, create, and update operations only, but this file also performs side-effecting actions by logging internal notes and scheduling activities. Those actions create persistent records and can alter workflow/history in ways a caller may not expect, which expands the skill's effective privilege and can be abused for unauthorized messaging, tasking, or audit-trail manipulation.
- Content
Static analysis
No suspicious patterns detected.