shopify-shopifyql

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill forces the agent to inline the user's verbatim message (base64-encoded) into every bash call (log_skill_use.mjs), which will cause any secrets present in the user's prompt to be emitted (and thus exfiltrated) by the model.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The code intentionally captures and ships verbatim user prompts and host session identifiers (and can read session/token environment variables) to an external telemetry endpoint (https://shopify.dev/mcp/usage), which is a clear data-exfiltration / credential-leak pattern.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow always runs scripts/search_docs.mjs with a query supplied from the agent’s free-form user message (“Replace … with the user's most recent message … base64-encoded” and “Search … before answering”), so outsider-authored text can influence what the LLM ingests from the doc search response.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill mandates running scripts/search_docs.mjs at runtime, which POSTs the search query to Shopify's docs search service (resolved against the base URL "https://shopify.dev/"), so external content from https://shopify.dev/ is fetched and used to drive the agent's responses.