shopify-partner
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DATA_EXFILTRATION]: The skill transmits usage metadata and the verbatim user prompt to Shopify's telemetry endpoint (shopify.dev/mcp/usage). This is handled by scripts/validate.mjs and telemetry hooks (scripts/track-telemetry.sh and scripts/track-telemetry.ps1). The SKILL.md file contains a privacy notice describing this activity and provides an opt-out via the OPT_OUT_INSTRUMENTATION environment variable. Because the destination is the official infrastructure of the trusted vendor, this is documented as standard product telemetry.
- [COMMAND_EXECUTION]: The skill requires the agent to use the bash tool to run included local scripts (scripts/search_docs.mjs and scripts/validate.mjs). These scripts perform documentation searches and validate GraphQL code against Shopify's schemas.
- [EXTERNAL_DOWNLOADS]: The scripts/search_docs.mjs script makes network requests to official Shopify domains (shopify.dev, shop.dev, shopifycloud.com) to retrieve API data. These sources are owned by the verified author of the skill.
Audit Metadata