Skills
Navigate
skills/40rty-ai/shopify-admin-skills/shopify-admin-order-attribution-report/Gen Agent Trust Hub

shopify-admin-order-attribution-report

Pass

Audited by Gen Agent Trust Hub on Jun 20, 2026

Risk Level: SAFEPROMPT_INJECTION
Full Analysis
  • [PROMPT_INJECTION]: The skill is subject to indirect prompt injection because it parses and processes data from landingPageUrl and utmParameters. These fields contain content generated by external users (storefront visitors) which could contain instructions intended to influence the agent's behavior during the reporting process.
  • Ingestion points: landingPageUrl and customerJourneySummary.firstVisit.utmParameters obtained from the Shopify orders GraphQL query in SKILL.md.
  • Boundary markers: The skill does not define explicit delimiters or instructions to ignore embedded commands when processing the URL strings.
  • Capability inventory: The skill utilizes shopify-admin tools to read sensitive order data and has the capability to write output to the user and local CSV files.
  • Sanitization: No explicit sanitization or validation of the UTM parameter values is described before aggregation and output generation.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 20, 2026, 10:05 AM
Security Audit — agent-trust-hub — shopify-admin-order-attribution-report