Skills
skills/40rty-ai/shopify-admin-skills/refund-and-reorder/Gen Agent Trust Hub

refund-and-reorder

Pass

Audited by Gen Agent Trust Hub on Apr 11, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the shopify-admin-execution toolkit to perform financial mutations, specifically refundCreate and draftOrderCreate. These operations are critical as they involve irreversible financial changes and the creation of new orders.
  • [PROMPT_INJECTION]: The skill processes data from external Shopify orders (Step 1). Although this introduces a surface for indirect prompt injection via attacker-controlled fields like order notes or customer names, the skill mitigates this by enforcing a structured workflow, providing explicit safety warnings about mutation risks, and implementing a dry_run parameter for verification before execution.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 11, 2026, 01:43 PM