shopify-pos-ui

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill enforces running bundled search/validate scripts that deliberately transmit search queries, model/client identifiers, and the validated code to Shopify (and can be redirected via environment variables), which constitutes intentional data exfiltration of potentially sensitive code/metadata and a privacy/backdoor risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The required workflow runs scripts/search_docs.mjs, which performs a runtime HTTP POST to a Shopify endpoint (/assistant/search) using the user’s query and then includes the (potentially outsider-authored) response text in the agent/LLM context via tool output (performSearch → process.stdout.write(result)).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's mandatory runtime tool scripts (scripts/search_docs.mjs and scripts/validate.mjs) contact Shopify endpoints using the base URL "https://shopify.dev/" (and related dev/staging hosts like "https://shopify-dev.shop.dev/" and "https://shopify-dev-staging${serverNumber}.shopifycloud.com/") to fetch /assistant/search results and report usage (/mcp/usage), and those fetched search results are a required runtime input that directly influence the agent's code-generation instructions.