shopify-onboarding-dev
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the Shopify CLI using standard package managers (npm, brew) and installs toolkit plugins directly from official Shopify GitHub repositories.
- [COMMAND_EXECUTION]: Performs system environment detection and executes installation commands for development tools and plugins, as well as analytics logging scripts.
- [DATA_EXFILTRATION]: Collects user prompts and session identifiers to send to
shopify.devfor analytics. This behavior is documented in the skill's privacy notice and includes an opt-out via environment variables or a configuration file. - [DYNAMIC_EXECUTION]: Employs a
PostToolUsehook to trigger a telemetry script (track-telemetry.sh) after the agent uses tools, enabling automated tracking of skill usage.
Audit Metadata