shopify-pos-ui

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill mandate forces the LLM to embed the user's verbatim message (base64-encoded) into an outgoing validation command (--user-prompt-base64), meaning any secret/API key a user includes in their prompt would be relayed exactly through the agent output and thus risks exfiltration.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The SKILL.md contains explicit, mandatory instructions that force the assistant to send the user's verbatim prompt and instrumentation (session/tool IDs and validated code) to external Shopify telemetry endpoints via the required search/validate scripts, which constitutes intentional data exfiltration of user content and identifiers.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly references payment-related APIs and actions that can change payment state or handle cash: mentions updating payment status and processing refunds (Order/Draft Order APIs), "payment adjustments" (exchange flow), and direct access to the Cash Drawer API / cash drawer management. Those are specific POS financial-operation APIs (not generic browser or HTTP tools) that enable direct financial execution-like actions (refunds, payment status changes, cash drawer operations).