shopify-admin-profit-margin-calculator
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns, code obfuscation, or unauthorized behaviors were detected in the skill instructions.
- [COMMAND_EXECUTION]: The skill references the official Shopify CLI (
shopify store auth) for session establishment, which is the standard and secure method for accessing Shopify store data. - [DATA_EXFILTRATION]: While the skill accesses sensitive financial data (orders, costs, revenue), it does so using legitimate read-only GraphQL operations. The data remains within the local agent environment and is not transmitted to external domains.
- [PROMPT_INJECTION]: Indirect Prompt Injection Surface:
- Ingestion points: External data enters the agent context via GraphQL query results for orders (names) and products (titles).
- Boundary markers: Absent in the current prompt instructions.
- Capability inventory: Limited to local file creation (CSV reports).
- Sanitization: Not explicitly specified in the skill workflow.
- Note: This is an expected risk surface for any data-processing skill and is assessed as low risk given the lack of dangerous capabilities like network exfiltration or shell execution.
Audit Metadata