ops-ecom
Fail
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: HIGHCREDENTIALS_UNSAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The setup flow performs an aggressive search for Shopify API tokens by scanning shell configuration files (~/.zshrc, ~/.bashrc, .zprofile, .envrc) and searching the macOS Keychain for 'shopify-admin-token' and 'shopify-access-token'.
- [CREDENTIALS_UNSAFE]: The skill recursively scans all .env files within the user's Projects directory (~/Projects//.env) for strings matching 'SHOPIFY_STORE' or 'SHOPIFY.*TOKEN'.
- [DATA_EXFILTRATION]: The skill attempts to discover store identities by directly querying the Google Chrome History SQLite database (~/Library/Application Support/Google/Chrome/Default/History) to extract myshopify.com URLs from previous admin sessions.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data from Shopify APIs (order names, customer details, and product titles) and processes it via sub-agents without explicit boundary markers or sanitization, creating a surface for indirect prompt injection.
- Ingestion points: Shopify REST API responses (orders, customers, products) processed in SKILL.md.
- Boundary markers: Absent; API data is interpolated directly into prompts.
- Capability inventory: The skill has access to Bash, Write, and Agent/TeamCreate capabilities to act on store data.
- Sanitization: Absent; the skill relies on raw JSON values from API responses.
- [COMMAND_EXECUTION]: The skill constructs and executes curl commands using variables (VARIANT_ID, NEW_PRICE, PROVIDED_TOKEN) resolved from external sources and local scans without validation or escaping.
Recommendations
- AI detected serious security threats
Audit Metadata