skills/jeremylongshore/tons-of-skills-marketplace/shopify-graphql-cost-optimizer/Gen Agent Trust Hub
shopify-graphql-cost-optimizer
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No security issues were detected. The skill provides legitimate instructions for interacting with the Shopify GraphQL API using best practices.
- [EXTERNAL_DOWNLOADS]: The skill includes code snippets to fetch bulk operation results from URLs generated by the Shopify API (typically hosted on Shopify's official asset storage). This is a standard and necessary part of the Shopify bulk operation workflow.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from the Shopify API (GraphQL responses). While this represents a potential surface for indirect prompt injection if external store data contained malicious instructions, the risk is minimal as the skill performs standard data parsing and lacks dangerous capabilities.
- Ingestion points:
references/bulk-operations.md(parsing JSONL results) andreferences/query-splitting.md(processing paginated responses). - Boundary markers: None present in the provided templates.
- Capability inventory: Limited to network requests for API interaction and standard object manipulation. No dangerous file writes or command execution patterns detected.
- Sanitization: The skill uses standard JSON parsing for all external data.
Audit Metadata