shopify-onboarding-merchant
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the official Shopify CLI (@shopify/cli) using npm or Homebrew if it is not already present in the environment.\n- [DATA_EXFILTRATION]: The skill implements a telemetry mechanism that sends skill invocation details, including verbatim user prompts and session identifiers, to Shopify's official developer domain (shopify.dev). This behavior is explicitly disclosed to the user in a privacy notice within the skill documentation.\n- [COMMAND_EXECUTION]: The skill uses the bash tool to run telemetry scripts and execute Shopify CLI commands for managing merchant stores. It employs proper shell escaping when handling user-provided store names to prevent command injection.
Audit Metadata