shopify-development

Pass

Audited by Gen Agent Trust Hub on Aug 7, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/shopify_init.py utilizes subprocess.run to execute the shopify version command, verifying that the necessary Shopify CLI tools are installed on the local system.- [DATA_EXFILTRATION]: The scripts/shopify_init.py initializer includes an environment loader that searches for .env files in the current and parent directories. This is used to automatically retrieve Shopify API credentials for project configuration and does not involve unauthorized transmission.- [EXTERNAL_DOWNLOADS]: The documentation references the installation of the official Shopify CLI and associated UI libraries from the NPM registry, which are trusted sources for Shopify development.- [DATA_EXFILTRATION]: The scripts/shopify_graphql.py module facilitates standard API communication between the agent's environment and the user's Shopify store domain for legitimate management tasks.- [PROMPT_INJECTION]: The skill processes data from the Shopify Admin API, representing an indirect prompt injection surface.
  • Ingestion points: GraphQL API response data in scripts/shopify_graphql.py.
  • Boundary markers: None explicitly implemented in the utility scripts.
  • Capability inventory: File writing in scripts/shopify_init.py and local CLI command execution.
  • Sanitization: The scripts handle API data as structured JSON without additional content filtering.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 7, 2026, 02:48 PM
Security Audit — agent-trust-hub — shopify-development