shopify-api-patterns
Warn
Audited by Snyk on Feb 16, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.80). The skill explicitly fetches and ingests external data (processBulkOperationResults(url) downloads and JSON-parses an arbitrary bulk-operation URL) and also reads product/metafield values via GraphQL (metafields.value, titles, tags) which can contain untrusted, user-generated content from merchants or the public.
Audit Metadata