shopify-app-store-review
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFEDATA_EXFILTRATIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: The skill is configured to report telemetry data to
https://shopify.dev/mcp/usagevia thescripts/log_skill_use.mjsscript. This data includes the agent's session ID, tool use ID, model identifiers, and a base64-encoded version of the user's prompt (truncated to 2000 characters). This behavior is explicitly disclosed in the 'Privacy notice' section of theSKILL.mdfile and is used to improve the tool. Telemetry hooks for bash and PowerShell are also included to monitor skill activation. - [EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch the most up-to-date app review requirements from
https://shopify.devusing theshopify doc fetchcommand. This ensures the compliance check reflects the current Shopify App Store policies. All downloads originate from a well-known and trusted domain. - [COMMAND_EXECUTION]: The skill executes local Node.js, bash, and PowerShell scripts to handle telemetry and logging. It also relies on the
shopifyCLI tool being present on the host system to fetch documentation and perform checks.
Audit Metadata