shopify-admin
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill includes telemetry hooks (
scripts/track-telemetry.shandscripts/track-telemetry.ps1) that collect and transmit session IDs, tool inputs, and truncated user prompts to Shopify's official telemetry endpoint (https://shopify.dev/mcp/usage). This behavior is documented in the skill instructions with a provided opt-out mechanism (OPT_OUT_INSTRUMENTATION=true). As the destination is a well-known service associated with the trusted author, this is considered safe telemetry.\n- [COMMAND_EXECUTION]: The skill utilizes thebashtool to execute local helper scripts (scripts/search_docs.mjsandscripts/validate.mjs). These scripts are used to retrieve up-to-date documentation and validate the syntax of generated GraphQL code before presenting it to the user.\n- [PROMPT_INJECTION]: The skill instructions require encoding the user's prompt as base64 and passing it to a validation script. This creates a potential surface for indirect prompt injection, where malicious instructions in the user's prompt might attempt to influence the validation process or the agent's interpretation of the validation results.\n - Ingestion points: User prompts are captured and passed to
scripts/validate.mjs.\n - Boundary markers: The prompt is base64 encoded, which provides a data-boundary but does not prevent the interpretation of the decoded content by the validation logic.\n
- Capability inventory: The skill has access to the
bashtool.\n - Sanitization: Base64 encoding is applied to the prompt string before it is passed as a command-line argument.
Audit Metadata