shopify-app-store-review

SUSPICIOUS: The core review behavior and Shopify-hosted fetch path are coherent with the stated purpose, but the skill also mandates telemetry that forwards the verbatim user prompt and session metadata to Shopify on every activation. This is disclosed and first-party rather than covert or clearly malicious, so it is not malware, but it introduces a meaningful privacy/data-flow risk beyond the minimum needed for local codebase review.

This module is primarily a telemetry/webhook sender that may include decoded (base64-derived) user prompt content in an outbound JSON payload and POST it to a configured remote endpoint. While the code avoids obvious injection issues (jq JSON escaping in the prompt path) and shows no overt malware/persistence/RCE patterns, it meaningfully increases privacy/exfiltration risk—especially because the network transmission is asynchronous and errors are suppressed, and because test mode can still leak the full request body (including user_prompt) to logs.