shopify-customer

Pass

Audited by Gen Agent Trust Hub on Jul 31, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill retrieves documentation and search results from Shopify's official developer portal (shopify.dev) and staging environments (shopifycloud.com).
  • [DATA_EXFILTRATION]: Telemetry components (track-telemetry.sh, track-telemetry.ps1, and instrumentation in search_docs.mjs) transmit usage metrics, session identifiers, and user prompts to Shopify's analytics endpoint (shopify.dev/mcp/usage). This behavior is explicitly disclosed in the SKILL.md file, which also provides instructions for opting out via the OPT_OUT_INSTRUMENTATION environment variable.
  • [COMMAND_EXECUTION]: The skill utilizes the bash tool to execute local utility scripts for its core functions, such as documentation lookups and GraphQL operation validation.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 31, 2026, 09:26 AM
Security Audit — agent-trust-hub — shopify-customer