ops-ecom

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (medium risk: 0.30). The skill scans multiple credential stores, shell history, password managers, and local browser state for API tokens and store URLs, representing aggressive local data discovery without clear malicious intent.

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill prompt instructs the LLM to scan various system credentials (Keychain, Dashlane, shell history, environment variables, Doppler, Chrome history, etc.) and read/handle sensitive API tokens (SHOPIFY_ADMIN_TOKEN, SHIPBOB_TOKEN) directly in shell commands and API requests via variables and headers.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill queries the Shopify Admin API and ShipBob API, which can contain user-submitted customer names, product titles, and order notes from untrusted store visitors or buyers.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill operates as a Shopify and ShipBob e-commerce command center (ops-ecom) that queries store data, monitors inventory, and performs management actions such as updating variant prices and managing fulfillments through API calls. These capabilities constitute direct operational control over e-commerce transactions, inventory adjustments, and status management. The instructions configure authentication headers using Shopify Admin API tokens (X-Shopify-Access-Token) and ShipBob bearer tokens, but do not establish an independent service-level or execution-layer access control mechanism on the payment or transaction-modifying routes themselves—relying entirely on the provided API tokens without separate human verification or independent authorization checks at execution time. Therefore, it falls under direct operations without established qualifying control.