init-vercel-shop
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [Project Initialization via CLI]: The skill uses the
npx create-vercel-shopcommand to scaffold a new project. This is a standard practice for creating modern web applications and uses an official tool provided by the vendor. - [Plugin Installation]: The instructions include steps to install additional functionality through official plugins from Vercel and Shopify. These represent expected extensions of the core storefront functionality.
- [Secure Authentication Flow]: The skill leverages the official Shopify CLI (
shopify store auth) to handle authentication. This is a secure approach that manages permissions through a well-known, trusted service rather than custom authentication logic. - [Secret Management Practices]: Sensitive data, such as Storefront access tokens, is written directly to a
.env.localfile. This is a recommended security practice to ensure that credentials remain local to the environment and are not exposed in code or logs. - [Safety Guardrails]: The skill includes explicit instructions for the AI agent to never print access tokens in responses and never to ask the user to paste sensitive tokens into the chat, reducing the risk of accidental data exposure.
Audit Metadata