shopify-built-for-shopify
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Instructs developers to include the Shopify App Bridge library from Shopify's official Content Delivery Network (CDN) at 'https://cdn.shopify.com/shopifycloud/app-bridge.js'.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to audit and review external code or application settings, which introduces a surface for indirect prompt injection if the audited content contains adversarial instructions.
- Ingestion points: Processes user-provided application code, configurations, and metadata during reviews or audits.
- Boundary markers: No specific delimiters or instructions for the agent to ignore embedded commands within the audited data are defined in this skill.
- Capability inventory: The impact of potential exploitation depends on the tools available to the executing agent (e.g., file system or network access).
- Sanitization: No explicit sanitization or validation of the input content is performed by the skill instructions.
Audit Metadata