Security audit

huo15-huihuo-suite

Security checks for vulnerabilities and agentic risk

Overview

This ERP skill matches its stated Odoo purpose, but it can store login secrets and perform sensitive business changes without enough safeguards.

Install only if you intend this skill to operate a real company Odoo account. Prefer a revocable API key with the least Odoo permissions needed, protect ~/.huo15/tools.md, and require explicit review before finance, HR approval, order confirmation, stock validation, RSVP-on-behalf-of-others, or deletion actions. The package should add narrower triggers, confirmation gates, and record-scope checks before broad deployment.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares no permissions while explicitly instructing use of shell commands, local credential file reads/writes, environment variables, and network access to a production Odoo instance. This creates a transparency and governance gap: operators or policy engines may treat the skill as lower risk than it is, even though it can handle secrets and perform privileged remote actions.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The documentation explicitly instructs users to call public attendee methods to accept, decline, or tentatively respond on behalf of any partner, and contrasts this with the safer current-user-only method. In a company Odoo skill, this normalizes impersonated RSVP changes and can let an operator alter attendance records, mislead organizers, or manipulate meeting participation without the attendee's consent.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The module documentation explicitly states that probability should not be manually written because Odoo uses dedicated workflow methods and internal invariants for won/lost/restore state handling. However, the update command allows arbitrary writes to the probability field, which can desynchronize pipeline forecasts, business logic, and reporting from the actual CRM stage/status, creating integrity issues in sales operations.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The state-changing commands (`done`, `reopen`, `cancel`) and `update` write directly to `project.task` by arbitrary numeric ID without verifying that each record belongs to the caller's declared private to-do scope (`user_ids` contains uid, `project_id` is false, `parent_id` is false). In this skill's context, that lets a user or upstream agent modify other task records reachable by ID, potentially including shared project tasks, causing unauthorized workflow changes and integrity issues in the company Odoo system.

Vague Triggers

High

Confidence: 97% confidence
Finding: The skill is configured to trigger on many bare, common workplace terms like tasks, projects, meetings, reminders, invoices, HR, and attendance, causing activation far outside explicit user intent. Because this skill can store credentials, access enterprise systems, and initiate state-changing ERP actions, accidental invocation could expose sensitive data or perform unintended operations in a production environment.

Vague Triggers

High

Confidence: 96% confidence
Finding: Aliases such as '待办事项', '加任务', '提醒我', '安排会议', '知识库', '本周安排', and similar everyday phrases are highly collision-prone with normal conversation. In a skill that interfaces with CRM, accounting, HR, calendar, and credential setup, these generic aliases increase the chance of unintended access to sensitive corporate data or unauthorized modifications triggered by ordinary speech.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: This reference document enumerates HR API fields and queries that include sensitive employee data such as private phone, private email, birthday, bank accounts, permits, and leave information, but it provides no privacy, authorization, or least-privilege guidance. In the context of an agent skill that operationalizes company Odoo actions, this increases the risk of over-collection, over-broad retrieval, and accidental disclosure of employee PII through prompts or automation flows.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The `pay` command creates an `account.payment` and immediately calls `action_post`, turning a user-supplied CLI invocation into a committed accounting transaction with no confirmation, dry-run, or safety interlock. In an accounting skill, this is risky because mistaken partner names, amounts, or automation misuse can directly cause unauthorized or erroneous financial postings that may be hard to reverse and can affect ledgers, reconciliation, and audit trails.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The code persists Odoo credentials, including the raw secret, into ~/.huo15/tools.md in plaintext. Even though it attempts to chmod the file to 0600 and mentions sensitivity in the generated file header, storing reusable authentication material unencrypted on disk increases exposure from local compromise, backups, sync tools, accidental sharing, or permission-setting failures on non-POSIX systems.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The cancel subcommand directly invokes Odoo's button_cancel on a purchase order with no interactive confirmation, dry-run, or secondary acknowledgment. In this ERP context, cancellation is a real business-state change that can disrupt procurement, receiving, and downstream accounting if triggered accidentally or by an over-broad natural-language instruction routed to this skill.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The bill subcommand creates a supplier invoice immediately via action_create_invoice without a runtime confirmation step. In a finance-capable ERP skill, accidental or manipulated invocation can create accounting records with operational and financial consequences, including duplicate or premature vendor bills.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The done command deletes calendar events immediately when --type event is used, with no confirmation, dry-run, or undo path. In an agent-driven context, a mistaken parameter interpretation or prompt-injection-induced action could silently remove legitimate meetings and reminders, causing operational disruption and loss of scheduling data.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The cancel command performs irreversible deletions of activities and events via unlink without any pre-action warning or confirmation. Because this skill manages real business records in Odoo, accidental or manipulated invocations can destroy reminders tied to sales, HR, or project workflows and make recovery difficult if audit/backup controls are weak.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The confirm command directly invokes Odoo's action_confirm write operation without any runtime confirmation gate, even though the file comments acknowledge this action has side effects such as converting a quotation into a sales order and potentially auto-creating delivery orders via sale_stock. In an agent skill context, this increases the risk of unintended state-changing actions from ambiguous user prompts, mis-parsing, or automation mistakes, leading to unauthorized order confirmation and downstream fulfillment activity.

Static analysis

No suspicious patterns detected.