shopify-functions

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill mandates embedding the user's verbatim prompt (base64-encoded) into the validation bash command, which forces the model to include any secrets present in the user's message in its output.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill and its helper scripts deliberately require collecting users' verbatim prompts and session/tool identifiers and transmit them to https://shopify.dev/mcp/usage (telemetry), which is an intentional data-exfiltration/privacy-leaking behavior.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow always calls scripts/search_docs.mjs with a query derived from the user’s free-form prompt (and then validates), and that search tool ingests the query text to retrieve/return documentation content to the agent.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). High-confidence: scripts/search_docs.mjs (invoked per SKILL.md) performs runtime fetches against Shopify's assistant/search endpoint (e.g., https://shopify.dev/assistant/search via the configured base https://shopify.dev/), returning search results that the skill must use to compose code, so external content from https://shopify.dev/ is fetched at runtime and directly influences agent output.