skills/vercel/shop/init-vercel-shop/Gen Agent Trust Hub

init-vercel-shop

Pass

Audited by Gen Agent Trust Hub on Jun 22, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • Remote Initialization Utility: The skill utilizes npx create-vercel-shop@latest to scaffold the project structure. This is a standard procedure for project initialization, fetching the latest scaffolding tools from the vendor's official registry.
  • Plugin Management: It provides retry commands for adding specific plugins (vercel/shop, vercel/vercel-plugin, Shopify/shopify-ai-toolkit). These plugins are sourced from official vendor and partner repositories to extend project functionality.
  • Secure Credential Handling: The instructions specifically guide the agent to write the SHOPIFY_STOREFRONT_ACCESS_TOKEN directly to a .env.local file. It explicitly warns against printing the token in the final response or asking the user to paste it into the chat, which aligns with industry best practices for managing secrets.
  • Automated Authentication Flow: The skill leverages the official shopify CLI for authentication and GraphQL operations. This ensures that interactions with the Shopify platform are handled through authorized and standardized tooling.
  • Indirect Injection Surface: The skill is designed to read a generated AGENTS.md file after the project is scaffolded. While this introduces an indirect ingestion point, the risk is minimal as the file is part of the freshly generated project template.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 22, 2026, 10:55 AM
Security Audit — agent-trust-hub — init-vercel-shop