shopify-theme-development
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the Shopify CLI and Theme tools using
npm install -g @shopify/cli @shopify/theme. These are official packages provided by Shopify for theme development. - [COMMAND_EXECUTION]: Provides standard commands for initializing and developing themes using the Shopify CLI (
shopify theme init,shopify theme dev). These are expected operations for the stated purpose of the skill. - [DATA_EXFILTRATION]: JavaScript examples use the Shopify AJAX API (
/cart/add.js,/cart/change.js,/cart.js) to manage cart state. These requests are made to the same origin as the store and do not involve external data exfiltration. - [INDIRECT_PROMPT_INJECTION]: The skill contains patterns for rendering untrusted data in Liquid templates.
- Ingestion points: Merchant-controlled data fields such as
product.descriptionand custom block settings (block.settings.text) are rendered insections/main-product.liquidandsections/collection-grid.liquid. - Boundary markers: Absent in the provided Liquid code snippets.
- Capability inventory: The skill enables the agent to create and modify theme files using standard development tools.
- Sanitization: The implementation relies on Shopify's default Liquid output escaping which is standard practice for this platform.
Audit Metadata