Huo15 Odoo19 Module Dev

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:50 AM UTC
• Version: 1.0.0

Overview

This Odoo development skill is mostly a normal guide, but one access-control template can grant all users full create, edit, and delete access if copied into a real module.

Review and change the security examples before using this skill to generate production Odoo modules. In particular, do not copy the blank-group full-CRUD ACL; define explicit groups, avoid delete permission by default, and add record rules/tests for portal, public, internal, and manager users.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:415

Finding

Globally Scoped ACL Template Grants Unrestricted CRUD Access

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 415–424
Vulnerability Type: Globally scoped access-control entry with full permissions
Risk Level: High

Vulnerable Code

csv

id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
access_my_model_user,my.model.user,model_my_model,base.group_user,1,1,1,1
access_my_model_manager,my.model.manager,model_my_model,,1,1,1,1

The accompanying guidance states that an empty group applies to all users:

text

- Empty = all users

Technical Analysis

The access_my_model_manager entry leaves group_id empty while enabling read, write, create, and delete permissions. In Odoo, an ACL without a group is globally applicable. ACL permissions are additive, so the group-restricted entry above it does not limit or override this unrestricted entry.

If a generated module adopts this template, every user able to access the model—including portal or public users where the deployment exposes applicable model or controller endpoints—may receive all four CRUD permissions. The entry's manager name does not impose a manager restriction; only an actual group reference would do so.

Attack Path

1. A developer copies the documented ACL template into an Odoo module.
2. The module is installed with the blank-group ACL enabled.
3. An unauthenticated, portal, or low-privilege user reaches an RPC, controller, or other exposed endpoint that operates on my.model.
4. Odoo evaluates the global ACL and grants read, write, create, and delete access.
5. The attacker enumerates, inserts, changes, or deletes model records, subject only to any separately configured record rules.
6. If no restrictive record rules exist, the granted access applies across all records in the model.

Impact Assessment

Successful exploitation can permit unauthorized disclosure, creation, alteration, and deletion of all records in the affected model. The ...[truncated 479 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the empty group_id with a dedicated manager group:

   csv

   id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
   access_my_model_user,my.model.user,model_my_model,base.group_user,1,1,1,0
   access_my_model_manager,my.model.manager,model_my_model,my_module.group_my_model_manager,1,1,1,1
   

2. Define my_module.group_my_model_manager explicitly and assign it only to authorized personnel.

3. Default destructive permissions such as perm_unlink to 0 for ordinary users.

4. Add record rules that constrain users to records they own or are authorized to manage.

5. Do not assign model ACLs to base.group_public or base.group_portal unless public or portal access is an explicit, reviewed requirement.

6. Add automated authorization tests covering anonymous, portal, internal-user, manager, and administrator contexts.

7. Update the documentation to warn that blank-group ACLs are global and should not be presented as a manager-access example.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 282)May include surrounding context.

xml

<?xml version="1.0" encoding="utf-8"?>
<odoo>
    <!-- 窗口动作 -->
    <record id="action_my_model" model="ir.actions.act_window">
        <field name="name">我的模型</field>
        <field name="res_model">my.model</field>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 312)May include surrounding context.

md

<field name="name"/>
    <field name="partner_id"/>
    <field name="date"/>
    <field name="amount_total" sum="合计"/>  <!-- sum/x editable 属性 -->
    <field name="state" widget="badge" decoration-success="state=='done'"/>
    <field name="active" invisible="1"/>
    <!-- 按钮 -->

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 325)May include surrounding context.

xml

<form>
    <sheet>
        <!-- 头部 -->
        <div class="oe_title">
            <h1>
                <field name="name" placeholder="名称..."/>

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger phrases are broad enough to match routine Odoo development requests, which can cause the skill to activate in contexts where the user did not explicitly request this specific module-development guidance. Unintended activation is a security-relevant quality issue because it can override or steer responses unexpectedly, especially in agent systems that auto-load skills based on keyword matching.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

文件整体描述和教学内容均固定为中文，未声明这是面向特定中文用户群的限定技能，也未提供可按用户偏好切换语言的说明。根据语言/locale 政策，强制单一语言而无用户选择可能构成自然语言层面的策略问题。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

该技能在别名中使用了“odoo模块”和“odoo19”这类范围很宽的触发词，未说明需要是“模块开发”场景才激活。用户只要提到 Odoo 19 或 Odoo 模块相关的一般讨论、安装或使用问题，就可能与该技能的激活条件重叠。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

“用户提到以下内容时激活本技能”后列出的是若干主题词，但没有说明仅限代码开发、脚手架、模型/视图实现等场景，也没有给出负例。像“Odoo 插件安装”这类表述还可能覆盖部署、运维或普通使用支持，导致技能激活边界模糊。

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 240)May include surrounding context.

md

class SaleOrder(models.Model):
    _inherit = 'sale.order'
    
    # 覆盖 create 方法
    @api.model
    def create(self, vals):
        # 添加默认值或预处理

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The natural-language content, including the description, section labels, and example interaction, is presented only in Chinese. There is no indication that the skill is region-specific or that users may choose another language, which can violate language/locale policy expectations when no opt-in is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest description is written entirely in Chinese and provides no indication that users can choose another language or locale. Under the policy criteria, a skill that appears to enforce a specific language without opt-in can constitute a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.