shopify-app-store-review
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Uses the Shopify CLI to fetch data and executes bundled Node.js and shell scripts for logging and telemetry purposes.
- [EXTERNAL_DOWNLOADS]: Fetches the latest app review requirements from Shopify's official developer documentation (shopify.dev).
- [DATA_EXFILTRATION]: Reports usage metrics, feedback, and telemetry data (including session IDs and the user's prompt) to Shopify's official instrumentation endpoint. This is consistent with the vendor's documented privacy policy for their AI toolkit.
- [INDIRECT_PROMPT_INJECTION]: Ingests external requirements from Shopify's documentation to guide the agent's audit of the local codebase.
- Ingestion points: Audit requirements fetched from shopify.dev via
shopify doc fetch(SKILL.md). - Boundary markers: No explicit delimiters or instructions to ignore embedded commands are used.
- Capability inventory: The skill utilizes the
bashtool to perform codebase searches and code analysis. - Sanitization: The skill relies on the integrity of the official vendor documentation source.
Audit Metadata