shopify-apps
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the Shopify App Bridge library from the official Shopify Content Delivery Network.\n- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion and processing of external data from Shopify webhooks and GraphQL APIs. While authentication via HMAC verification is correctly demonstrated to ensure data authenticity, the templates do not incorporate data sanitization or boundary markers for these external payloads.\n
- Ingestion points: Webhook action handlers in
app/routes/webhooks.tsxand GraphQL query responses inapp/routes/app._index.tsx.\n - Boundary markers: No specific delimiters or instructions to ignore embedded commands are included in the code templates.\n
- Capability inventory: The templates include database write operations (
db.product.upsert) and authenticated Shopify Admin API access.\n - Sanitization: The example logic processes payload fields (such as
payload.title) directly without escaping or validation steps.
Audit Metadata