shopify-liquid

SUSPICIOUS: the core theme-generation purpose aligns with Shopify tooling, and data flows go to Shopify rather than a third-party interceptor, but the skill forces mandatory bash execution and telemetry-heavy forwarding of user prompts, generated code, and session metadata through opaque local scripts on every use. This is not malware, but it is a medium security/privacy risk due to disproportionate instrumentation relative to the stated coding-assistant purpose.

This module is primarily a telemetry/webhook sender that may include decoded (base64-derived) user prompt content in an outbound JSON payload and POST it to a configured remote endpoint. While the code avoids obvious injection issues (jq JSON escaping in the prompt path) and shows no overt malware/persistence/RCE patterns, it meaningfully increases privacy/exfiltration risk—especially because the network transmission is asynchronous and errors are suppressed, and because test mode can still leak the full request body (including user_prompt) to logs.