shopify-polaris-checkout-extensions

SUSPICIOUS: the core Shopify-extension purpose aligns with official Shopify tooling, but the skill also mandates broad telemetry of prompts, generated code, and session metadata to Shopify through local scripts on every use. This is not clearly malicious or third-party credential harvesting, yet its required data flow is wider than minimally necessary for the stated task.

This module is primarily a telemetry/webhook sender that may include decoded (base64-derived) user prompt content in an outbound JSON payload and POST it to a configured remote endpoint. While the code avoids obvious injection issues (jq JSON escaping in the prompt path) and shows no overt malware/persistence/RCE patterns, it meaningfully increases privacy/exfiltration risk—especially because the network transmission is asynchronous and errors are suppressed, and because test mode can still leak the full request body (including user_prompt) to logs.