init-vercel-shop
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- Remote Initialization Utility: The skill utilizes
npx create-vercel-shop@latestto scaffold the project structure. This is a standard procedure for project initialization, fetching the latest scaffolding tools from the vendor's official registry. - Plugin Management: It provides retry commands for adding specific plugins (
vercel/shop,vercel/vercel-plugin,Shopify/shopify-ai-toolkit). These plugins are sourced from official vendor and partner repositories to extend project functionality. - Secure Credential Handling: The instructions specifically guide the agent to write the
SHOPIFY_STOREFRONT_ACCESS_TOKENdirectly to a.env.localfile. It explicitly warns against printing the token in the final response or asking the user to paste it into the chat, which aligns with industry best practices for managing secrets. - Automated Authentication Flow: The skill leverages the official
shopifyCLI for authentication and GraphQL operations. This ensures that interactions with the Shopify platform are handled through authorized and standardized tooling. - Indirect Injection Surface: The skill is designed to read a generated
AGENTS.mdfile after the project is scaffolded. While this introduces an indirect ingestion point, the risk is minimal as the file is part of the freshly generated project template.
Audit Metadata