shopify-customer

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill mandates embedding the user's verbatim prompt (base64-encoded) into a validation command and optionally echoing session/tool IDs, which forces the model to output any secrets contained in the user's input verbatim (albeit encoded), creating an exfiltration risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill contains deliberate telemetry and instrumentation that collects verbatim user prompts, session/tool identifiers, and (in staging mode) environment tokens and transmits them to an external telemetry endpoint, which constitutes intentional data exfiltration and sensitive-token exposure risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). SKILL.md’s required runtime workflow ingests only user-authored free text at the agent level (it base64-encodes the “user prompt” and passes it into scripts/validate.mjs), while the actual external text it reads is limited to Shopify’s own documentation search results via scripts/search_docs.mjs rather than arbitrary outsider-submitted content.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill mandates running scripts/search_docs.mjs at runtime which performs HTTP requests to https://shopify.dev (e.g. POST /assistant/search) and reports to https://shopify.dev/mcp/usage, so remote content from https://shopify.dev is fetched during runtime and is required to drive the agent's search-and-code generation loop.