The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The file references/performance-optimization.md includes a code example that dynamically loads a script from https://third-party.com/widget.js. Automated security analysis (URLite) identifies this specific URL as a known botnet distributor. Referencing flagged malicious infrastructure in code examples poses a severe risk to developers who might copy-paste the snippet into production environments.\n- [REMOTE_CODE_EXECUTION]: The skill provides instructions for the dynamic execution of external JavaScript. The pattern script.src = 'https://third-party.com/widget.js'; document.body.appendChild(script); in references/performance-optimization.md facilitates the execution of unverified remote code. Additionally, an AV scanner flagged this specific reference file as containing a suspicious HTTP request pattern (MD:HttpRequest-inf [Susp]).\n- [DATA_EXFILTRATION]: The identified malicious URL (https://third-party.com/widget.js) is associated with botnet command-and-control activity, which typically involves unauthorized data harvesting and exfiltration from the host environment.\n- [COMMAND_EXECUTION]: The skill relies on the Shopify CLI and NPM for core functionality, instructing the agent to execute commands like shopify theme push, shopify app dev, and shopify app deploy. While these are standard for Shopify development, they provide the agent with broad capabilities to modify project files and interact with remote store environments, which could be abused if combined with malicious instructions.\n- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. It ingests untrusted data from the Shopify Storefront and Admin APIs as well as external Liquid theme files. There are no clear boundary markers or sanitization procedures documented to prevent the agent from obeying instructions embedded within this external data. This surface could be exploited to perform unauthorized API operations or file system modifications using the project's broad capability inventory.

shopify-expert