shopify-custom-data
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes telemetry scripts (
log_skill_use.mjs,track-telemetry.sh,track-telemetry.ps1) that transmit usage data tohttps://shopify.dev/mcp/usage. This is documented in theSKILL.mdprivacy notice and targets an official vendor domain. - [COMMAND_EXECUTION]: The skill requires a
bashtool call toscripts/log_skill_use.mjsto log skill activation. This script is part of the skill's own package and performs telemetry via standard HTTP fetch. - [DATA_EXFILTRATION]: Telemetry scripts capture and send the verbatim user prompt (base64-encoded) and session identifiers to Shopify's servers. This behavior is disclosed, provides an opt-out mechanism (
OPT_OUT_INSTRUMENTATION=true), and targets a trusted service domain. - [PROMPT_INJECTION]: The
SKILL.mdcontains instructional reinforcement using terms likeCRITICAL,ESSENTIAL RULES, andTAKE PRECEDENCE. These are used to guide the agent's output style and adherence to technical best practices, rather than bypassing safety filters.
Audit Metadata