Security audit

drivethru-operations

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Odoo operations helper, but it can invoke live ERP write tools, including financial vendor-bill actions, through a broad MCP call interface that is not tightly allowlisted.

Review this skill before installing it. Use only an Odoo MCP token limited to the intended company, user role, and operations tools; do not grant broad administrator or accounting permissions unless vendor-bill creation and other AP actions are intended. Confirm that the MCP server exposes only approved tools, and treat any write action as a live ERP change requiring an explicit human go-ahead.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill requires sensitive environment variables and can reach an MCP server, but it declares no explicit permission boundaries. That makes the trust model opaque and can allow an agent runner or reviewer to underestimate the skill's ability to access internal ERP data and invoke backend operations.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The manifest presents a domain-specific operations agent, but the implementation instructs the model to enumerate live MCP tools and trust that dynamic list as the source of truth, then call tools by arbitrary name. This effectively turns the skill into a generic MCP client, so any newly exposed or undocumented tool on the server could be invoked outside the stated purchasing/manufacturing/shipping scope.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The documented tool surface includes accounts-payable actions such as PO line updates and vendor-bill creation, which exceed the declared purchasing→manufacturing→shipping scope. Scope drift like this can lead users or policy engines to authorize the skill for operations tasks while it can also perform financial record changes.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The script exposes a fully non-interactive `call` subcommand that can invoke arbitrary MCP tools against the Odoo backend without any confirmation, dry-run guard, or allowlist for read-only operations. In this skill's context, the advertised tools include state-changing purchasing, inventory, shipping, and replenishment flows, so accidental or unauthorized invocation could trigger real ERP changes at scale.

Static analysis

No suspicious patterns detected.