shopify-development
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The initialization script
scripts/shopify_init.pyexecutes theshopify versioncommand to verify that the Shopify CLI is installed on the user's system. This is a benign environment check. - [EXTERNAL_DOWNLOADS]: The documentation and setup scripts reference official Shopify developer tools, including the
@shopify/cliand associated UI extension libraries from the public NPM registry. These are well-known resources provided by a trusted service. - [INDIRECT_PROMPT_INJECTION]: The skill defines templates for interacting with external Shopify store data.
- Ingestion points: GraphQL queries in
SKILL.mdandscripts/shopify_graphql.pyfetch data from the Shopify Admin API. - Boundary markers: The provided templates do not include explicit instructions to treat the ingested data as untrusted.
- Capability inventory: The skill can perform network operations and execute CLI commands for project setup.
- Sanitization: The scaffolding scripts focus on API connectivity and project structure rather than input sanitization.
Audit Metadata