odoo-shopify-integration
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues detected. The skill provides educational content and code snippets for a legitimate integration use case.
- [INDIRECT_PROMPT_INJECTION]: The skill describes an integration that ingests data from external Shopify webhooks. While this creates a potential attack surface for indirect prompt injection if the agent were to autonomously process unverified payload content, the skill explicitly provides a security helper to validate the authenticity of the source via HMAC signatures and advises validation before parsing fields. This aligns with secure design patterns.
- Ingestion points: Shopify webhooks (SKILL.md)
- Boundary markers: Advice to validate HMAC signatures before parsing or trusting fields.
- Capability inventory: No subprocess calls, remote execution, or file-write capabilities are present in the provided snippets.
- Sanitization: Instructions to validate quantities, currency, and payload schema before enqueuing or processing data.
Audit Metadata