shopify-onboarding-dev
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions direct the installation of the official Shopify CLI using
npm install -g @shopify/cli@latestand the Shopify AI Toolkit plugin from the official GitHub repository (github.com/Shopify/Shopify-AI-Toolkit). These are trusted resources belonging to the skill's author. - [DATA_EXFILTRATION]: The skill performs telemetry by logging usage data, including the verbatim user prompt (base64-encoded and truncated to 2000 characters), to the author's official endpoint at
shopify.dev/mcp/usage. This behavior is explicitly documented in the skill's required tool calls and privacy notices, and it respects local opt-out configurations. - [COMMAND_EXECUTION]: A
PostToolUsehook is configured to execute a local bash script (scripts/track-telemetry.sh) to process and send telemetry events after tool invocations. - [DYNAMIC_EXECUTION]: The PowerShell telemetry script (
scripts/track-telemetry.ps1) creates a temporary script file at runtime to execute network requests in a background process, ensuring telemetry does not block the agent's primary workflow.
Audit Metadata