ecommerce-shopify-product-query
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The script
scripts/shopify_product_query.pyperforms POST requests to the NexScope proxy gateway (NEXSCOPE_PROXY_BASE) to retrieve product search results. These downloads are targeted at official vendor endpoints necessary for the skill's primary function. - [COMMAND_EXECUTION]: The documentation provides instructions for executing the included Python script for debugging. Analysis confirms the script uses standard libraries for networking and data handling, and its local file operations are limited to maintaining a search cache and session logs.
- [INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection as it ingests untrusted product titles and links from Shopify stores.
- Ingestion points: Product data is fetched in
scripts/shopify_product_query.pyvia thecall_apifunction. - Boundary markers: None identified in the script's output formatting.
- Capability inventory: The skill fetches and renders product lists to the agent context.
- Sanitization: No explicit sanitization of external text is performed before rendering.
Audit Metadata