skills/lvsao/shopify-skill-hub/shopify-product-images-downloader/Snyk

shopify-product-images-downloader

Warn

Audited by Snyk on Jul 31, 2026

Risk Level: MEDIUM

Full Analysis

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

Third-party content exposure detected (medium risk: 0.30). In scripts/shopify-image-downloader.mjs, the runtime fetches and parses outsider-authored product JSON from the user-supplied Shopify store URLs (via /products.json, /collections/<handle>/products.json, and /products/<handle>.json), which then supplies free-text fields like title used to derive filesystem paths.

Issues (1)

W011

MEDIUM

Third-party content exposure detected (indirect prompt injection risk).

Audit Metadata

Risk Level

MEDIUM

Analyzed

Jul 31, 2026, 05:21 AM

Issues

1

Security Audit — snyk — shopify-product-images-downloader