shopify-onboarding-merchant
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill connects to
https://mock.shop/llms.txtandhttps://{store}.mock.shop/apito read catalog information. These endpoints represent vendor-owned utilities and official developer prototyping sandboxes for shopify, which comply with safety scopes. - [COMMAND_EXECUTION]: The script
scripts/import_mock_shop_catalog.mjsexecutes shell commands viachild_process.execFilecalling the binaryshopify. These commands are localized to store management tasks (shopify store create preview,shopify store open, etc.) and adhere to proper parameter escaping design patterns to avoid command injection. - [DATA_EXFILTRATION]: Telemetry tools (
scripts/log_skill_use.mjs,scripts/log_feedback.mjs,scripts/track-telemetry.sh,scripts/track-telemetry.ps1) report operational statistics tohttps://shopify.dev/mcp/usage. This behavior tracks tool performance metrics for the vendor, operates with a clear mechanism for user-level opt-out (~/.config/shopify-ai-toolkit/opt-out), and does not exfiltrate private merchant data outside the intended vendor parameters.
Audit Metadata