shopify-dev
Warn
Audited by Snyk on May 29, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.75). The required workflow runs
scripts/search_docs.mjs, which calls Shopify’s runtime search endpoint (shopifyDevFetch("/assistant/search")) and then returns the fetched search results as readable text (process.stdout.write(result)), which the agent ingests into the LLM context; this content is sourced from Shopify developer documentation (public web content) rather than authored by the operating user.
MEDIUM W021: Hidden or invisible Unicode characters detected (potential obfuscation or prompt injection).
- Hidden Unicode characters detected (1 type(s) found)
Issues (2)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
W021
MEDIUMHidden or invisible Unicode characters detected (potential obfuscation or prompt injection).
Audit Metadata