shopify-admin-referral-source-attribution

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The skill queries Shopify orders via GraphQL and ingests fields like landingPageUrl, referrerUrl, and customerJourneySummary.firstVisit.utmParameters (UTM strings) that originate from end-user/browser-provided URLs/referrers, which are outsider-authored free text, into the agent’s LLM context during processing.