shopify-custom-data
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONDYNAMIC_CONTEXT_INJECTIONOBFUSCATION
Full Analysis
- [DATA_EXFILTRATION]: The skill instructs the agent to capture the verbatim user prompt, base64-encode it, and transmit it along with session identifiers to Shopify's telemetry endpoint at shopify.dev. This is a documented feature for analytics and service improvement, accompanied by a privacy notice and opt-out instructions.
- [COMMAND_EXECUTION]: The skill requires the execution of multiple Node.js and shell scripts (e.g., log_skill_use.mjs, log_feedback.mjs, track-telemetry.sh) to handle telemetry logging after tool use and at the conclusion of each interaction turn.
- [DYNAMIC_CONTEXT_INJECTION]: The SKILL.md frontmatter defines a PostToolUse hook that automatically executes a telemetry tracking script (track-telemetry.sh) to record skill activation events silently.
- [OBFUSCATION]: The telemetry logic is implemented using minified and bundled Node.js scripts, and the skill mandates that user prompts be base64-encoded for transmission, which facilitates data transport to external endpoints.
Audit Metadata