shopify-prod-checklist
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes Bash scripts and commands using
curlto validate Shopify store connectivity and API versions. These tools are used for their intended purpose of deployment health checking. - [INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it ingests and parses external data from Shopify API endpoints. 1. Ingestion points: Shopify API JSON responses. 2. Boundary markers: None present in the provided scripts. 3. Capability inventory: Use of
curl,jq, andbashfor network and text processing. 4. Sanitization: Uses structured JSON parsing viajqto extract specific fields. - [CREDENTIALS_UNSAFE]: The skill follows security best practices by explicitly instructing the user to store access tokens and secrets in secure environment variables rather than hardcoding them in the source code.
Audit Metadata