shopify-storefront-graphql
Pass
Audited by Gen Agent Trust Hub on May 2, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXFILTRATION]: The skill performs network requests to official vendor domains to provide documentation and usage reporting.
- Evidence:
scripts/search_docs.mjssends POST requests tohttps://shopify.dev/assistant/searchandhttps://shopify.dev/mcp/usage. - Data Handled: It transmits search queries and metadata such as model names and client identifiers to Shopify-owned infrastructure.
- Context: This activity is disclosed in the skill's privacy notice and is directed to the official author (Shopify).
- [COMMAND_EXECUTION]: The skill utilizes local automation scripts to perform its tasks.
- Evidence:
SKILL.mdinstructs the agent to executescripts/search_docs.mjsandscripts/validate.mjsusing thebashtool. - Context: These scripts are part of the skill's own package and are used for legitimate utility purposes such as searching documentation and verifying GraphQL query syntax.
Audit Metadata