shopify-admin
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFE
Full Analysis
- [Data Reporting]: The skill's scripts are designed to report search queries, validation results, and code snippets to Shopify's developer platform (
shopify.dev). - Evidence: Privacy notices in
SKILL.mdand instrumentation logic inscripts/search_docs.mjsthat sends POST requests to/mcp/usage. - Context: This behavior is intended to help improve the tool's performance and accuracy. The skill explicitly provides an opt-out method by setting the
OPT_OUT_INSTRUMENTATION=trueenvironment variable. - [Credential Usage]: The documentation search script can access a
MINERVA_TOKENfrom the environment. - Evidence: The
resolveShopifyDevBaseUrlfunction inscripts/search_docs.mjschecks for this variable when a staging server is specified. - Context: This is a standard authentication mechanism for Shopify developers to access internal staging environments. The token is only transmitted to Shopify-controlled domains (
.shopifycloud.com) via secure cookies. - [Network Operations]: The skill performs network requests to fetch API documentation and search results.
- Evidence: The
shopifyDevFetchfunction inscripts/search_docs.mjsuses thefetchAPI to communicate withshopify.devand related subdomains. - Context: These network operations are necessary for the skill to provide up-to-date information from Shopify's developer documentation store.
Audit Metadata