shopify-admin-promo-code-bulk-generator
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill exposes a surface for indirect prompt injection through its reliance on user-supplied parameters that are interpolated into GraphQL mutations.
- Ingestion points: The skill processes several external inputs via parameters such as
prefix,store,starts_at,ends_at, andvaluedefined in SKILL.md. - Boundary markers: No explicit delimiters or instruction-ignore warnings are provided for the interpolated parameter values.
- Capability inventory: The skill utilizes the
shopify-admin-executiontoolkit to performdiscountCodeBasicCreatemutations on a Shopify store and generates a local CSV file. - Sanitization: There is no explicit sanitization, validation, or escaping logic described in the instructions to handle potentially malicious content within the user-supplied parameters.
Audit Metadata