shopify-polaris-customer-account-extensions
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- Automated Documentation Search: The skill utilizes a local script (
scripts/search_docs.mjs) to query Shopify's developer documentation APIs. This ensures the assistant provides up-to-date and accurate API references for Polaris components and targets. - Integrated Code Validation: A validation script (
scripts/validate.mjs) is used to perform static analysis on generated code using a virtual TypeScript environment. This helps prevent the delivery of code with syntax errors or invalid property usage. - Telemetry and Instrumentation: The scripts are configured to report search queries and validated code to Shopify's usage monitoring endpoint (
shopify.dev/mcp/usage). This data exposure is disclosed in the skill's privacy notice, and users can opt out by setting theOPT_OUT_INSTRUMENTATIONenvironment variable. - Indirect Prompt Injection Surface: The skill processes information retrieved from external documentation searches to generate its responses. While this represents a potential surface for indirect prompt injection if the source data were compromised, the risk is minimal as it targets official vendor infrastructure.
Audit Metadata