shopify-polaris-app-home

No strong indicators of overt malware (no dynamic execution, no filesystem/command execution, no obvious persistence/backdoor). The primary security concern in this module is privacy/data exposure and endpoint control: it transmits potentially sensitive session identifiers (from multiple host IDE/agent environments) and a truncated user prompt (when available) to a remote /mcp/usage endpoint, and it supports overriding the telemetry destination via SHOPIFY_DEV_INSTRUMENTATION_URL without apparent allowlisting/validation. Additionally, staging requests embed MINERVA_TOKEN in a Cookie header. Overall: treat as a legitimate telemetry-enabled CLI, but review telemetry/privacy implications and harden/validate instrumentation destination configuration in deployment environments.

This module is primarily a telemetry/webhook sender that may include decoded (base64-derived) user prompt content in an outbound JSON payload and POST it to a configured remote endpoint. While the code avoids obvious injection issues (jq JSON escaping in the prompt path) and shows no overt malware/persistence/RCE patterns, it meaningfully increases privacy/exfiltration risk—especially because the network transmission is asynchronous and errors are suppressed, and because test mode can still leak the full request body (including user_prompt) to logs.