shopify-mcp-server

SUSPICIOUS: The skill’s Shopify management purpose matches its broad API scopes and data flows to Shopify, but trust is weakened by inconsistent publisher/repo/package identity and by forwarding store credentials to a non-Shopify third-party npm package. This looks more like a legitimate but high-trust integration than confirmed malware; main concerns are supply-chain provenance and autonomous write access to a live store.