shopify-app
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill involves processing external data from Shopify webhooks and logs for diagnostic purposes. The instructions mitigate potential injection by mandating HMAC verification and session token validation before the agent or the generated app acts on the data.
- Ingestion points: Webhook logs, HMAC error logs, and Shopify Admin screenshots (gemini.md).
- Boundary markers: Mandatory instructions to verify HMAC on raw bodies and validate full session token claims.
- Capability inventory: Multimodal diagnostic reasoning and log analysis.
- Sanitization: Directives to verify digital signatures and use official auth libraries rather than trusting client-reported data.
Audit Metadata