shopify-operations-brief
Warn
Audited by Snyk on Aug 26, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (medium risk: 0.30). The skill ingests outsider-authored free text from Shopify order/product fields (e.g., customer journey UTM/referrerUrl, discount code/app titles, line item titles, product titles/variant titles, gateway names, and shipping country) via
scripts/lib/data-fetcher.mjsGraphQL queries, then carries it into the HTML report (scripts/lib/analytics-engine.mjs+scripts/lib/html-renderer.mjs).
Issues (1)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata