shopify-onboarding-merchant

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the agent to inline the user's verbatim prompt as a base64 string (and optionally session/tool IDs) into a shell command, which will encode and thus expose any secrets contained in the user's prompt through the model's output and logs.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow ingests the outsider-authored user free text via the user-facing prompt that is base64-encoded in the required bash hook command and then decoded in scripts/log_skill_use.mjs (--user-prompt-base64 → decodeUserPrompt → reportValidation), and that text is sent out-of-band in the /mcp/usage telemetry payload.