shopify-development
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/shopify_init.pyutilizessubprocess.runto execute theshopify versioncommand, verifying that the necessary Shopify CLI tools are installed on the local system.- [DATA_EXFILTRATION]: Thescripts/shopify_init.pyinitializer includes an environment loader that searches for.envfiles in the current and parent directories. This is used to automatically retrieve Shopify API credentials for project configuration and does not involve unauthorized transmission.- [EXTERNAL_DOWNLOADS]: The documentation references the installation of the official Shopify CLI and associated UI libraries from the NPM registry, which are trusted sources for Shopify development.- [DATA_EXFILTRATION]: Thescripts/shopify_graphql.pymodule facilitates standard API communication between the agent's environment and the user's Shopify store domain for legitimate management tasks.- [PROMPT_INJECTION]: The skill processes data from the Shopify Admin API, representing an indirect prompt injection surface. - Ingestion points: GraphQL API response data in
scripts/shopify_graphql.py. - Boundary markers: None explicitly implemented in the utility scripts.
- Capability inventory: File writing in
scripts/shopify_init.pyand local CLI command execution. - Sanitization: The scripts handle API data as structured JSON without additional content filtering.
Audit Metadata