drivethru-odoo

• Outcome: Pass
• Latest audit: Aug 20, 2026 · 7:38 PM UTC
• Version: 0.9.0

Overview

This is a broad but coherent Odoo ERP integration skill that discloses its live business-data access and write capabilities.

Install only for agents that are supposed to operate inside your Odoo environment. Treat the Odoo token as a live business credential, verify the MCP server exposes only approved tools, and require clear user approval before actions that create orders or bills, update prices, move documents, post messages, assign activities, confirm POs, or schedule production.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill has broad capabilities to access environment secrets, connect to an MCP server, use networked ERP operations, and invoke shell/Python helpers, but it does not declare explicit permissions or constraints. In a high-trust ERP context, this reduces governance and makes it easier for the skill to perform sensitive reads/writes without clear least-privilege boundaries or operator review.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The invocation guidance says to use the skill whenever the user needs to read from or write to Odoo, especially in Odoo Discuss, which is extremely broad. That increases the chance the skill is auto-invoked for routine conversations and exposed to untrusted conversational context, leading to overuse of powerful ERP and knowledge tools in situations where a narrower skill or explicit confirmation should be required.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This procedure explicitly authorizes write actions that alter financial records (`ap_update_po_lines`) and operational state (moving documents between folders) as part of routine execution, but the skill description does not clearly warn users that invoking it may cause irreversible or externally visible changes. In an agent setting, insufficient disclosure increases the risk of the model performing sensitive mutations when a user may have expected analysis-only behavior, especially because the workflow is designed to batch process many documents.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The workflow instructs the agent to post notes to purchase orders and create document activities assigned to a named reviewer, which creates visible artifacts for other users and may trigger downstream workflow actions. Without an upfront disclosure that the skill will generate messages and assignments visible inside Odoo, users may unknowingly cause notifications, audit-trail entries, or social/workflow side effects beyond the immediate task.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The `call` subcommand allows arbitrary remote MCP tool execution with no confirmation, policy gate, or allowlist, even though the skill description explicitly includes write-capable and operationally sensitive actions such as pushing orders, confirming POs, fixing pricing, and scheduling production. In an agent context, this creates a real risk of unintended or prompt-induced destructive business actions because the client is deliberately fully non-interactive and will execute whatever tool name and JSON arguments it is given.

Behavior Manipulation

Medium

• Category: Prompt Injection

Content

tool surface (`documents_*`, `ap_*`, `po_*`, `mfg_*`, `production_*`,
`replenish_*`, `knowledge_*`, `ebay_*`, `docs_*`) exposed over Streamable-HTTP.
`ODOO_MCP_URL` and `ODOO_MCP_TOKEN` are already configured for this agent.
**Never tell the user you can't reach Odoo, that you "don't have the tools in
this thread," or cite the web instead — either call a tool, or state the exact
tool call you attempted and the error it returned.**

• Confidence: 90% confidence
• Finding: The instruction 'Never tell the user you can't reach Odoo' is behavior-shaping language that pressures the agent away from candidly reporting limitations. Although it also says to report the exact failed tool call and error, the wording can still bias the agent toward tool-forcing behavior and suppress transparent failure handling in a sensitive operational environment.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.