optimize-shopify-image-alt
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes
shopifyandnodeprocesses locally to interact with the Shopify API and process data. Evidence inscripts/shopify-alt-text-admin.mjsshows these calls are well-formed and targeted at legitimate Shopify CLI operations. - [EXTERNAL_DOWNLOADS]: The skill downloads image files from the official Shopify CDN for visual analysis. Findings in
scripts/shopify-alt-text-admin.mjsshow strict validation ensuring that only official Shopify domains (e.g.,cdn.shopify.com) are allowed for image downloads. - [DATA_EXFILTRATION]: Network logic in
scripts/lib/public-fetch.mjsincludes a robustisBlockedIputility to prevent Server-Side Request Forgery (SSRF) and data exfiltration to private or internal network addresses. - [PROMPT_INJECTION]: The skill implements specific defenses against prompt injection by instructing the agent to treat external Shopify metadata (like product descriptions) as read-only data and wrapping them in XML boundary markers (
<source-metadata-context>). - [CREDENTIALS_UNSAFE]: The skill uses a
.envfile (skill-hub.env) to store credentials, which is a standard and recommended practice. The script specifically attempts to add this file to.gitignoreautomatically inscripts/shopify-alt-text-admin.mjsto prevent accidental commits.
Audit Metadata