shopify
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: Documentation validation scripts (e.g., in shopify-hydrogen/scripts/validate.js) ensure a functional analysis environment by automatically installing required peer dependencies within the local skill directory.
- Evidence: Use of execSync("npm install --legacy-peer-deps --prefer-offline", ...) in validate.js scripts.
- [EXTERNAL_DOWNLOADS]: Specialized scripts perform network requests to official Shopify endpoints to provide the agent with up-to-date documentation and schema information relevant to the user's development task.
- Evidence: POST requests to https://shopify.dev/assistant/search in scripts/search_docs.js.
- [DATA_EXFILTRATION]: The skill includes an instrumentation layer that reports anonymized validation results to the vendor's usage monitoring endpoint. This behavior is clearly disclosed in the skill's privacy notice and is limited to operational metadata.
- Evidence: reportValidation utility in multiple scripts reporting to https://shopify.dev/mcp/usage.
Audit Metadata