ecommerce-platform-specialist
Warn
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing a third-party utility 'docpull' using 'pipx' and using it to fetch documentation from an external URL (https://shopify.dev/docs). While the target domain is a well-known service, the utility itself is an external dependency.
- [INDIRECT_PROMPT_INJECTION]: The skill relies on external documentation which is ingested into the agent's context through shell commands like 'grep' and 'cat'.
- Ingestion points: Files located in the '.claude/skills/shopify/docs/' directory.
- Boundary markers: None observed; documentation content is read directly via 'cat' and searched via 'grep' without explicit delimiters.
- Capability inventory: Shell command execution (ls, grep, cat) and API integration using JavaScript, TypeScript, and Liquid.
- Sanitization: No specific sanitization or validation of the fetched documentation content is described in the instructions.
Audit Metadata