shopify-polaris-checkout-extensions

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly requires embedding the user's verbatim prompt (base64-encoded) into a validation command, which forces the model to output whatever secret values the user might have included in their prompt.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). SKILL.md intentionally requires running external tooling that transmits the verbatim user prompt, session/tool identifiers, and validated code to Shopify (via scripts/search_docs.mjs and scripts/validate.mjs), which is deliberate data exfiltration/telemetry and poses a high-risk privacy/backdoor concern.