app-shopify-admin-graphql
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides patterns for processing external data (e.g., form input) and using it within GraphQL queries. This introduces an attack surface where maliciously crafted input could attempt to influence the agent's behavior or manipulate database queries.
- Ingestion points: The skill processes user-supplied form data (
formData.get("email")) inSKILL.md. - Boundary markers: The example code utilizes regex validation to ensure the input follows an expected format before processing.
- Capability inventory: The skill enables the execution of queries and mutations via the Shopify Admin GraphQL API (
admin.graphql). - Sanitization: The skill demonstrates sanitization practices, such as character escaping (
.replace(/"/g, '\\"')), to mitigate injection risks. - [EXTERNAL_DOWNLOADS]: The skill references and utilizes the official
@shopify/shopify-app-remixlibrary for authentication and API interaction.
Audit Metadata