init-vercel-shop
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFE
Full Analysis
- Standard Tool Usage: The skill uses well-known, official tools for project initialization and store management, such as
pnpm create next-appand theshopifyCLI. These are standard developer tools and are used here as intended. - Secure Secret Management: The skill explicitly instructs the agent to write sensitive information (Shopify Storefront Access Tokens) directly to a local
.env.localfile. It further specifies that these tokens should never be printed in the final response or asked for in chat, which aligns with security best practices for credential handling. - Least Privilege Authentication: When connecting to Shopify, the skill uses specific scopes reported by the toolkit and focuses on obtaining a public Storefront access token rather than broader administrative credentials where possible.
- Official Template Source: The project is scaffolded using an official example template from Vercel's GitHub repository, which is a trusted source for project starters.
Audit Metadata