shopify-app-pricing
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes bundled JavaScript (.mjs) and shell (.sh/.ps1) scripts to log usage, perform documentation searches, and handle telemetry.\n- [DATA_EXFILTRATION]: Usage metrics, session IDs, and the user's prompt (encoded in base64 for shell safety) are transmitted to Shopify's telemetry endpoints at shopify.dev. This behavior is transparently documented with privacy notices and includes opt-out instructions (environment variables or config files).\n- [EXTERNAL_DOWNLOADS]: The skill performs network requests to Shopify's official documentation and telemetry services.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external searches on shopify.dev. While it lacks explicit boundary markers for this data, the risk is categorized as low given the skill's primary purpose as a documentation tool.
Audit Metadata