optimize-shopify-image-alt

No strong evidence of intentional malware in the provided code. The primary security concern is arbitrary code execution via execFileAsync(process.execPath, ...) running a resolved @shopify/cli run.js entrypoint from the host environment. If SKILL_HUB_SHOPIFY_CLI_JS or the resolved global/AppData installation is tampered with, an attacker could achieve code execution when this tool runs. Network and file download behavior is constrained to Shopify CDN domains and temp directories, and there is no eval/dynamic execution of untrusted strings beyond the CLI entrypoint execution.