shopify
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the official
@shopify/clipackage from the NPM registry. This is a legitimate tool provided by a well-known service for platform development. - [COMMAND_EXECUTION]: Instructions involve running Shopify CLI commands for project management and a local initialization script
scripts/shopify_init.pyfor project setup. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates processing external data via Shopify's GraphQL/REST APIs and webhooks. While this creates a surface for indirect injection from store data, the skill includes guidance on mitigation, such as verifying webhook signatures and requesting minimal access scopes.
Audit Metadata