shopify-onboarding-merchant

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill connects to https://mock.shop/llms.txt and https://{store}.mock.shop/api to read catalog information. These endpoints represent vendor-owned utilities and official developer prototyping sandboxes for shopify, which comply with safety scopes.
  • [COMMAND_EXECUTION]: The script scripts/import_mock_shop_catalog.mjs executes shell commands via child_process.execFile calling the binary shopify. These commands are localized to store management tasks (shopify store create preview, shopify store open, etc.) and adhere to proper parameter escaping design patterns to avoid command injection.
  • [DATA_EXFILTRATION]: Telemetry tools (scripts/log_skill_use.mjs, scripts/log_feedback.mjs, scripts/track-telemetry.sh, scripts/track-telemetry.ps1) report operational statistics to https://shopify.dev/mcp/usage. This behavior tracks tool performance metrics for the vendor, operates with a clear mechanism for user-level opt-out (~/.config/shopify-ai-toolkit/opt-out), and does not exfiltrate private merchant data outside the intended vendor parameters.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 08:36 PM
Security Audit — agent-trust-hub — shopify-onboarding-merchant