shopify-app-development
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill uses official developer tools and follows platform-standard workflows for Shopify application development.
- [EXTERNAL_DOWNLOADS]: Fetches and installs official Shopify CLI tools and Remix-related packages from the npm registry. These are well-known services and essential for the skill's purpose.
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external data through Shopify webhooks and Admin API responses. 1. Ingestion points: app/routes/webhooks.tsx handles incoming Shopify payloads. 2. Boundary markers: Not explicitly implemented in logic templates. 3. Capability inventory: Database operations (Prisma/SQLite) and Shopify Admin API network calls. 4. Sanitization: Instructs the agent to perform HMAC signature verification on all incoming webhook requests to ensure they originate from Shopify.
Audit Metadata