hydrogen-analytics-tracking

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly loads third-party JavaScript at runtime (e.g. the GTM bootstrap: https://www.googletagmanager.com/gtm.js?id=…), which will fetch and execute remote code in-site and is relied on as a required runtime dependency for the tracking pipeline.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the entire skill docs for literal credentials. I found one high-entropy secret-like value in references/webhook-forwarding-via-builder.md:
• Example response / environment variable example:
• "signingSecret": "9b8a7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f9a8b"
• Later shown as SHOPIFY_WEBHOOK_SECRET=9b8a7c6d...

This matches the doc's description ("32-byte hex from crypto.randomBytes") and is a 64-hex-character string (high entropy). Per the secret definition, this is a credential that would be used to verify webhooks and therefore qualifies as a secret present in the docs.

Other literal tokens in the doc (G-XXXXXXX, GTM-XXXXX, META_TEST_EVENT_CODE, placeholders like ${WEAVERSE_API_KEY}, PUBLIC_STORE_DOMAIN, etc.) are documentation placeholders or public-by-design IDs and I ignored them per the rules (they are not high-entropy real secrets). No PEM blocks or API bearer tokens (sk-... ) or other live credentials were found.