shopify-apps
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [SAFE]: No malicious patterns or obfuscation techniques were detected. The skill serves as a legitimate technical guide for developers.
- [COMMAND_EXECUTION]: The skill provides standard CLI commands for initializing and deploying Shopify applications, such as
npm init @shopify/app@latestandshopify app deploy. - [EXTERNAL_DOWNLOADS]: The templates include references to Shopify's official Content Delivery Network (CDN) to load the App Bridge library from
https://cdn.shopify.com/shopifycloud/app-bridge.js. - [PROMPT_INJECTION]: The skill demonstrates processing of untrusted webhook data from Shopify.
- Ingestion points: Webhook request payloads in
app/routes/webhooks.tsx. - Boundary markers: HMAC verification is correctly implemented using
authenticate.webhook(request)to ensure the data source is authentic. - Capability inventory: The patterns involve database operations via Prisma (
db.product.upsert) and GraphQL API calls to the Shopify Admin API. - Sanitization: While HMAC verification ensures the source, the templates do not explicitly show input sanitization of the payload content before database storage.
Audit Metadata