shopify-catalog
Pass
Audited by Gen Agent Trust Hub on Jun 29, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches current documentation and input schemas from the official Shopify developer portal (shopify.dev). These are well-known resources from a trusted service provider.
- [COMMAND_EXECUTION]: The skill configuration allows the use of the Bash tool. While the instructions do not include specific shell scripts, this capability is provided for general development and catalog management tasks within the project environment.
- [PROMPT_INJECTION]: The skill establishes an ingestion point for external data by instructing the agent to use web search and fetch tools to retrieve documentation. While this creates a surface for indirect prompt injection, the searches are scoped to official Shopify domains.
- Ingestion points: SKILL.md (via WebSearch and WebFetch tools)
- Boundary markers: Absent in instructions
- Capability inventory: Write, Edit, Bash, Grep, Glob
- Sanitization: Absent
Audit Metadata