shopify-gmc-misrep-auditor
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill requires running Node.js scripts (
gmc-store-audit.mjsandgmc-product-audit.mjs) to perform store and product audits. - [EXTERNAL_DOWNLOADS]: The auditing scripts fetch HTML content and metadata from external Shopify store URLs. A
validateSafeUrlutility is included in both scripts to validate target URLs and block requests to internal or private IP addresses, preventing potential SSRF vulnerabilities. - [DATA_EXFILTRATION]: No patterns of unauthorized data exfiltration were detected. Network activity is limited to fetching data from the specified Shopify store for compliance analysis.
- [PROMPT_INJECTION]: The skill implements a 'Data Sandboxing' rule in the
SKILL.mdfile, which explicitly directs the agent to treat all crawled content as untrusted read-only data and to ignore any potential instructions or commands embedded within that content.
Audit Metadata