app-auth
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a comprehensive developer guide for Shopify integration. The provided code snippets demonstrate robust security patterns and align with official Shopify development standards.
- [PROMPT_INJECTION]: No evidence of prompt injection, instruction overrides, or attempts to bypass safety filters was found in the documentation or metadata.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill explicitly advises against insecure practices like storing access tokens in client-side cookies or hardcoding credentials. It provides examples of secure token management using environment variables and persistent database storage (Prisma, Redis).
- [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: All referenced libraries are either official Shopify packages (@shopify/shopify-app-remix, @shopify/shopify-api) or well-known industry-standard tools (express, axios, prisma). No remote code execution patterns or untrusted script downloads were detected.
- [INDIRECT_PROMPT_INJECTION]: The skill defines handlers for external data ingestion through webhooks and app proxies. It provides necessary security controls for these surfaces, specifically implementing HMAC signature validation to verify data authenticity and timestamp checks to prevent replay attacks.
Audit Metadata