shopify-setup
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Installs the official Shopify CLI (@shopify/cli) via npm. This is a standard package from a well-known service provider.
- [COMMAND_EXECUTION]: Executes shell commands for CLI installation, authentication, and API verification. These are standard operations for store management.
- [INDIRECT_PROMPT_INJECTION]: The skill interpolates user-provided data, such as store domains and API tokens, directly into shell commands and curl requests.
- Ingestion points: User-provided store domain and Admin API access token in SKILL.md.
- Boundary markers: None present for the interpolated values.
- Capability inventory: npm installation, shopify CLI commands, and network requests via curl in SKILL.md.
- Sanitization: No explicit sanitization of the input values before command interpolation.
Audit Metadata