shopify-admin-product-affinity-cross-sell
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements market basket analysis to compute product affinity metrics (support, confidence, lift) based on Shopify order history. All operations are read-only and align with the stated purpose.
- [COMMAND_EXECUTION]: The skill references standard Shopify CLI commands for authentication (
shopify auth login), which is the expected method for accessing the designated environment. - [DATA_EXPOSURE]: The skill requests access to order and product data via GraphQL (
orders:query). This access is necessary for the analytical function and is scoped to theread_ordersandread_productspermissions as documented. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the Shopify API (product titles, tags). While this represents a potential injection surface, the skill instructs the agent to perform mathematical frequency analysis rather than interpreting the content as instructions. The risk is minimized by the analytical context.
Audit Metadata