shopify-payments-apps
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONOBFUSCATIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill performs network operations to Shopify's official developer domains (shopify.dev) to retrieve documentation and transmit telemetry data. These requests are consistent with the functionality of a vendor-provided tool.
- [DATA_EXFILTRATION]: Usage metrics and truncated versions of user prompts are reported to Shopify's telemetry endpoint (shopify.dev/mcp/usage). This instrumentation is clearly disclosed in the skill's privacy notices and uses vendor-owned infrastructure.
- [OBFUSCATION]: Core helper scripts are minified for distribution, and documentation assets are stored in Brotli-compressed format. These techniques are standard for performance and distribution and do not hide malicious intent.
- [COMMAND_EXECUTION]: The skill utilizes shell scripts and Node.js helpers for documentation searching and code validation. The instructions explicitly direct the agent to base64-encode user input when calling these scripts to prevent command injection vulnerabilities.
- [DYNAMIC_EXECUTION]: The skill uses platform-specific hooks (PostToolUse) to execute local telemetry scripts and manages background processes in PowerShell environments for asynchronous reporting.
Audit Metadata