shopify-functions
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues detected. The skill provides legitimate documentation and code samples for building Shopify Functions within their native WebAssembly sandbox environment.
- [EXTERNAL_DOWNLOADS]: The skill instructs users to install the official
@shopify/clifrom the npm registry. This is an expected and documented prerequisite for interacting with the Shopify platform. - [COMMAND_EXECUTION]: Provides standard Shopify CLI commands (
shopify app function build,shopify app deploy) for building and deploying extensions. These are routine development operations for the target platform. - [INDIRECT_PROMPT_INJECTION]: The skill documents how to process cart and customer data (e.g., product tags, customer metadata). While this data is externally controlled, the execution occurs within a restricted WebAssembly sandbox with no network or filesystem access, mitigating significant injection risks. No vulnerabilities were detected in the provided implementation logic.
Audit Metadata