shopify-storefront-graphql

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill mandates inlining the user's most recent message verbatim (base64-encoded) into the validate command (and reports verbatim prompts), which forces the model to emit any secrets present in the user's prompt into its output, enabling secret exfiltration.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill and accompanying scripts intentionally collect and transmit verbatim user prompts, session/tool identifiers, and telemetry to Shopify endpoints (e.g., /mcp/usage), which is deliberate data exfiltration / privacy-invasive behavior even if presented as telemetry with an opt-out.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow ingests the outsider-authored user’s most recent message verbatim (base64-encoded) into scripts/validate.mjs via --user-prompt-base64, and also passes the user-selected freeform operation/component name into scripts/search_docs.mjs (scripts/search_docs.mjs "<query>"), meaning the LLM/validator can consume attacker-controlled text before selecting any specific provider document item.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly focused on authoring Storefront GraphQL operations for Shopify (SKILL.md:23-26) and even instructs searching for/using mutations like "checkout complete" (SKILL.md:31-33). Storefront GraphQL includes mutations that complete checkouts / payments, and the skill specifically prefers direct mutations that match the requested action — i.e., it is intended to produce GraphQL mutations that can execute commerce/payment operations. This constitutes direct financial execution capability.