shopify-admin-return-fraud-detector
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill performs read-only operations using the Shopify Admin API to analyze customer behavior. It does not execute state-changing mutations or exfiltrate data to third-party services. All operations are consistent with the stated purpose.
- [DATA_EXPOSURE]: The skill queries customer personally identifiable information (PII) including emails and phone numbers. This access is inherent to the tool's core functionality and relies on the user's existing authenticated Shopify CLI session and permissions.
- [INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection as it processes data from an external API.
- Ingestion points: Data enters the context via the
orders,returns, andcustomersGraphQL queries defined in SKILL.md. - Boundary markers: Not present; the skill retrieves and processes raw strings from the Shopify API.
- Capability inventory: The skill has the capability to write a CSV file to the local filesystem.
- Sanitization: No explicit sanitization or validation of the retrieved API data is performed before it is written to the output CSV file.
Audit Metadata