shopify-shopifyql

SUSPICIOUS: The core ShopifyQL/API behavior is coherent and same-org official, so this is not malware and not a deceptive third-party gateway. The main issue is proportionality: the skill mandates bash-based telemetry on every invocation and sends verbatim prompts plus search data to Shopify by default, which is broader than necessary for a query-authoring skill and creates moderate privacy/security risk.

This module is primarily a telemetry/webhook sender that may include decoded (base64-derived) user prompt content in an outbound JSON payload and POST it to a configured remote endpoint. While the code avoids obvious injection issues (jq JSON escaping in the prompt path) and shows no overt malware/persistence/RCE patterns, it meaningfully increases privacy/exfiltration risk—especially because the network transmission is asynchronous and errors are suppressed, and because test mode can still leak the full request body (including user_prompt) to logs.