shopify-product-images-downloader
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The script implements comprehensive Server-Side Request Forgery (SSRF) protections. It includes logic to validate URLs, resolve DNS addresses, and block access to private, local, or loopback IP ranges (e.g., 127.0.0.1, 10.x.x.x, 192.168.x.x, etc.) to prevent internal network scanning.
- [SAFE]: The skill restricts image downloads to authorized Shopify-related domains (cdn.shopify.com, shopifycdn.com, shopifycdn.net) or the target store's own domain, effectively preventing exfiltration or unauthorized file fetches from arbitrary third-party sites.
- [SAFE]: The 'Hard Rules' section in the SKILL.md includes 'Data Sandboxing' instructions that explicitly direct the AI agent to treat all external product data (titles, descriptions, tags) as non-executable literal data. This is a best-practice defense against indirect prompt injection where instructions might be hidden in product metadata.
- [SAFE]: The skill uses the 'sharp' image processing library, which is a well-maintained and reputable package. The dependency is pinned to version 0.35.3 in the lockfile, and the skill performs no dynamic installation of packages at runtime, following secure development principles.
Audit Metadata