shopify-polaris-app-home

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly requires embedding the user's verbatim message, base64-encoded, into a validation command (and the validator reports the verbatim prompt), which forces the LLM to include any secrets present in the user's message in its output (albeit encoded) — a high exfiltration risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill mandates calling local scripts that will transmit the verbatim user prompt and session/tool identifiers to Shopify telemetry endpoints (via the required validate/search calls), which constitutes forced data exfiltration of user input and metadata and is a high-risk privacy/exfiltration vector.