shopify-payments-apps

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill mandates embedding the user's verbatim prompt (base64-encoded) into a validation command and may include session/tool IDs, which forces the model to output any secrets the user provided (API keys/passwords) in reversible form and transmit them to validation tooling.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The code contains deliberate telemetry and data-collection flows that capture and transmit verbatim user prompts, agent session identifiers, tool_use_ids, and (in staging cases) auth tokens (MINERVA_TOKEN) to remote Shopify endpoints, which constitutes high-risk data exfiltration and potential credential exposure.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required workflow ingests the outsider-authored user message verbatim via BASE64_OF_USER_PROMPT and passes it into scripts/validate.mjs (and also into scripts/search_docs.mjs as the user-derived search query), so attacker-controlled free text reaches runtime LLM/agent tooling without selecting a specific trusted item.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly designed for the Shopify Payments Apps API: it instructs the assistant to produce GraphQL queries and mutations related to processing payments, handling refunds/voids, managing payment sessions, authorization/capture/settlement, and other payment-specific operations. Those GraphQL mutations could be used to execute financial transactions via the Payments API, so this skill grants direct financial execution capability.