shopify-admin-customer-merge
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements legitimate business logic for merging customer data using the official Shopify API version 2025-01. It does not attempt to bypass any platform security controls.
- [SAFE]: No patterns of prompt injection, obfuscation, or data exfiltration were found. The skill operates exclusively within the context of an authenticated Shopify session provided by the user.
- [SAFE]: The skill requires a pre-authenticated Shopify CLI session ('shopify store auth') with specific scopes ('read_customers', 'write_customers'), ensuring that it operates under the principle of least privilege and relies on existing user-authorized credentials.
- [SAFE]: Defensive coding practices are evident, such as the 'dry_run' parameter defaulting to true, which forces a preview of the merge plan before any data-modifying mutations are executed.
Audit Metadata