shopify-storefront-graphql
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill makes network requests to official Shopify domains, including shopify.dev and shopifycloud.com, to retrieve documentation search results and report telemetry.
- [DATA_EXFILTRATION]: Scripts such as search_docs.mjs and track-telemetry.sh collect session identifiers and truncated user prompts, transmitting them to the vendor's usage endpoint. This behavior is documented in the skill's privacy notice and honors the OPT_OUT_INSTRUMENTATION environment variable.
- [COMMAND_EXECUTION]: The skill utilizes the bash tool to execute local Node.js and shell scripts (search_docs.mjs, validate.mjs) which are required for searching the API catalog and performing code validation.
Audit Metadata