shopify-store-setup-auditor

SUSPICIOUS: the Shopify audit/fix scope is largely coherent and credentials are proportionate, but the forced silent `npx skills update` and transitive skill installation materially raise trust risk. Without the bundled script code, credential handling and exact network destinations cannot be fully verified.

This module is primarily an integration utility for running Shopify GraphQL queries. It does not contain overt malicious payloads (no eval, no suspicious network beacons to arbitrary domains, no obvious system damage). However, it has two security-relevant trust-boundary issues: (1) resolveCli() can execute an arbitrary local script path when config.SKILL_HUB_SHOPIFY_CLI_JS is set to an existing file (node will run that path), which could enable arbitrary code execution if config is attacker-controlled; (2) config.storeInput is directly used in fetch() URLs without hostname allowlisting, creating a potential SSRF risk where sensitive credentials/tokens may be sent to unintended hosts. Overall, likely safe when config is fully trusted, but risky under untrusted configuration.