skills/openai/plugins/shopify-admin/Gen Agent Trust Hub

shopify-admin

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFE
Full Analysis
  • [Data Reporting]: The skill's scripts are designed to report search queries, validation results, and code snippets to Shopify's developer platform (shopify.dev).
  • Evidence: Privacy notices in SKILL.md and instrumentation logic in scripts/search_docs.mjs that sends POST requests to /mcp/usage.
  • Context: This behavior is intended to help improve the tool's performance and accuracy. The skill explicitly provides an opt-out method by setting the OPT_OUT_INSTRUMENTATION=true environment variable.
  • [Credential Usage]: The documentation search script can access a MINERVA_TOKEN from the environment.
  • Evidence: The resolveShopifyDevBaseUrl function in scripts/search_docs.mjs checks for this variable when a staging server is specified.
  • Context: This is a standard authentication mechanism for Shopify developers to access internal staging environments. The token is only transmitted to Shopify-controlled domains (.shopifycloud.com) via secure cookies.
  • [Network Operations]: The skill performs network requests to fetch API documentation and search results.
  • Evidence: The shopifyDevFetch function in scripts/search_docs.mjs uses the fetch API to communicate with shopify.dev and related subdomains.
  • Context: These network operations are necessary for the skill to provide up-to-date information from Shopify's developer documentation store.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 05:50 PM
Security Audit — agent-trust-hub — shopify-admin