The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The file references/performance-optimization.md contains code that dynamically loads a script from https://third-party.com/widget.js. Automated security scans have flagged this specific URL as being associated with botnet activity. Loading and executing external scripts at runtime poses a significant security risk as the remote content can be modified to perform malicious actions.
[REMOTE_CODE_EXECUTION]: The skill documents and provides code snippets for executing remote scripts and binaries. Specifically, the JavaScript loadScripts pattern in references/performance-optimization.md facilitates the execution of external code. Additionally, the skill utilizes cargo wasi build for Shopify Functions, which involves compiling and running WebAssembly modules.
[DATA_EXFILTRATION]: Code examples in references/checkout-customization.md demonstrate the exfiltration of sensitive order data, including product line items and order IDs, to an external domain (https://your-app.com/api/upsell). While the domain used is a placeholder, the logic establishes a functional pathway for sending shop data to external servers.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core function of processing untrusted external data.
Ingestion points: The skill reads and processes Shopify theme files (.liquid), configuration schemas (theme.json), and external API data from the Shopify Storefront API as described in SKILL.md and references/storefront-api.md.
Boundary markers: There are no instructions or delimiters defined to prevent the agent from following malicious commands hidden within the Liquid templates or API responses it processes.
Capability inventory: The skill has access to the file system and can execute powerful CLI commands like shopify theme push and shopify app deploy.
Sanitization: No evidence of input validation or sanitization is present for data ingested from the merchant storefront or third-party integrations.
[METADATA_POISONING]: There is a discrepancy between the author identified in the platform context ('polip') and the author listed in the skill's YAML metadata (https://github.com/Jeffallan). This inconsistency can be used to mask the true origin of the skill.

shopify-expert