shopify-onboarding-dev

SUSPICIOUS: The core Shopify setup behavior is mostly aligned and uses official Shopify distribution channels, but the mandatory logging of the verbatim user prompt to Shopify is disproportionate for an onboarding skill. Combined with transitive plugin installation and unpinned installs, this raises medium security risk without proving malicious intent.

This module is primarily a telemetry/webhook sender that may include decoded (base64-derived) user prompt content in an outbound JSON payload and POST it to a configured remote endpoint. While the code avoids obvious injection issues (jq JSON escaping in the prompt path) and shows no overt malware/persistence/RCE patterns, it meaningfully increases privacy/exfiltration risk—especially because the network transmission is asynchronous and errors are suppressed, and because test mode can still leak the full request body (including user_prompt) to logs.