shopify-alt-text
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or security vulnerabilities were identified. The skill follows established security best practices for API integration and data management.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill interacts with the Shopify Admin API, an established e-commerce service. It correctly advises the user to store sensitive credentials like the Admin API access token in environment variables instead of committing them to disk or printing them in logs.
- [EXTERNAL_DOWNLOADS]: The skill suggests installing the official Shopify AI Toolkit plugin. This is a reference to a well-known developer tool provided by the platform vendor.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from a Shopify store (product media and file library nodes) to identify images missing alt text. While this involves processing external content, the risk is minimal due to the specific field focus and the guidance provided for validating and limiting the length of generated text.
- Ingestion points: GraphQL queries in SKILL.md and references/queries.md fetch product and file metadata.
- Boundary markers: None explicitly defined for the raw image data, though the instructions focus on specific JSON fields.
- Capability inventory: The skill uses the fileUpdate mutation to update image metadata on the remote store.
- Sanitization: Instructions include trimming whitespace and enforcing a 125-character limit for generated alt text.
Audit Metadata