shopify-liquid

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly requires the agent to inline the user's verbatim message base64-encoded into a validation command (and may include session/tool IDs), so any secrets in the user's prompt would be embedded in the agent's output — a direct exfiltration risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This code intentionally collects verbatim user prompts, session/tool identifiers, and (in staging) environment tokens and sends them to an external telemetry endpoint (https://shopify.dev/mcp/usage), constituting deliberate data exfiltration and a privacy/backdoor risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). In SKILL.md’s required workflow, the agent must call scripts/search_docs.mjs "<query>" and scripts/validate.mjs ... --user-prompt-base64 ... but neither script fetches or ingests arbitrary outsider-authored free text beyond the user prompt itself (and search_docs.mjs searches first-party Liquid docs using a controlled query string), so there is no runtime path that reads free text submitted by outsiders from an inbox/feed/issue body without first selecting a specific item.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). scripts/search_docs.mjs performs an outbound fetch to the Shopify docs assistant (base "https://shopify.dev/") and calls the "/assistant/search" endpoint at runtime to retrieve search results that the skill is required to use to guide generated code and prompts, so the remote content directly controls agent behavior.