post-purchase-ui-extension
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for the agent to execute shell commands to validate code using the TypeScript compiler.\n
- Evidence: The agent is told to run
npx tsc --noEmitwithin the user's extension directory.\n- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to trigger on and process local files, creating a potential surface for instructions embedded in data to influence agent behavior.\n - Ingestion points: Files within
extensions/*post-purchase*/directories.\n - Boundary markers: No specific boundary markers or sanitization instructions for external content are provided.\n
- Capability inventory: Shell command execution via npx tsc.\n
- Sanitization: None mentioned.\n- [EXTERNAL_DOWNLOADS]: The skill references resources from well-known services for documentation and software development kits.\n
- Evidence: References to
@shopify/post-purchase-ui-extensions-reactand documentation atshopify.dev.
Audit Metadata