Clawpify

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:55 AM UTC
• Version: 0.1.0

Overview

This is a legitimate Shopify admin helper, but it needs review because it can change or delete live store data and create persistent webhooks without consistent confirmation safeguards.

Review before installing. Use a least-privileged Shopify token, prefer read-only scopes when possible, and require a fresh explicit confirmation before any write, delete, refund, fulfillment, subscription, shipping, discount, marketing-consent, bulk, or webhook operation. Verify webhook destinations are controlled by you, minimize customer/order exports, and use backups or a test store for broad changes.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/locations.md:147
• Finding: High-Impact Shopify Mutations Lack Consistent Explicit Confirmation Controls## Vulnerability Details **File Locations**: - `references/blogs.md:104-114, 309-319` - `references/files.md:242-252` - `references/locations.md:147-195` - `references/markets.md:144-154` - `references/menus.md:222-232` - `references/pages.md:193-203` - `references/segments.md:106-116` - `references/shipping.md:236-246` - `references/subscriptions.md:264-344` - Related incomplete central policy: `SKILL.md:22-33` **Vulnerability Type**: Missing authorization confirmation for destructive and business-impacting operations **Risk Level**: Medium ### Vulnerable Code Representative location and inventory-routing mutations from `references/locations.md:147-195`: ```graphql ## Activate Location mutation ActivateLocation($locationId: ID!) { locationActivate(locationId: $locationId) { location { id isActive } userErrors { field message } } } ## Deactivate Location mutation DeactivateLocation($locationId: ID!, $destinationLocationId: ID) { locationDeactivate(locationId: $locationId, destinationLocationId: $destinationLocationId) { location { id isActive } userErrors { field message } } } Note: When deactivating, inventory moves to the destination location. ## Delete Location mutation DeleteLocation($locationId: ID!) { locationDelete(locationId: $locationId) { deletedLocationId userErrors { field message } } } ``` Representative subscription mutations from `references/subscriptions.md:264-344`: ```graphql ## Commit Draft (Activate) mutation CommitSubscriptionDraft($draftId: ID!) { subscriptionDraftCommit(draftId: $draftId) { contract { id status } userErrors { field message } } } ## Pause Subscription mutation PauseSubscription($subscriptionContractId: ID!) { ...[truncated 3861 chars]
• Remediation: ## Remediation Suggestions 1. Expand `SKILL.md` so every destructive, externally visible, billing-related, subscription-related, and inventory-routing mutation requires explicit approval. 2. Add a `REQUIRES PERMISSION` block immediately before each affected mutation rather than relying only on a central policy. 3. Before execution, retrieve and display: - Resource type, title, and Shopify GID. - Current state and proposed state. - All affected records. - Inventory, billing, customer, shipping, and storefront consequences. - Whether the operation is reversible. 4. Require a new, unambiguous confirmation such as “confirm” after presenting the final mutation plan. Do not treat the original request as confirmation. 5. For bulk operations, enumerate the resources or provide a bounded summary and require separate confirmation. 6. Apply least-privilege Shopify scopes so the integration cannot perform unrelated mutations. 7. Add a centralized mutation-risk registry that defaults unknown write operations to confirmation-required. 8. Record the approving user, timestamp, mutation name, target IDs, and resulting Shopify response in an audit log. 9. Add automated tests that verify no deletion, activation, cancellation, billing, publishing, or inventory-routing mutation can execute without a confirmation state.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/webhooks.md:70
• Finding: Webhook Creation and Endpoint Updates Can Establish Unapproved Persistent Data Flows## Vulnerability Details **File Location**: `references/webhooks.md:70-278` **Related incomplete policy**: `references/webhooks.md:352-365` **Vulnerability Type**: Missing confirmation and destination validation for persistent external data delivery **Risk Level**: Medium ### Vulnerable Code HTTP webhook creation from `references/webhooks.md:70-99`: ```graphql ## Create HTTP Webhook mutation CreateWebhook($topic: WebhookSubscriptionTopic!, $webhookSubscription: WebhookSubscriptionInput!) { webhookSubscriptionCreate(topic: $topic, webhookSubscription: $webhookSubscription) { webhookSubscription { id topic endpoint { ... on WebhookHttpEndpoint { callbackUrl } } } userErrors { field message } } } ``` ```json { "topic": "ORDERS_CREATE", "webhookSubscription": { "callbackUrl": "https://myapp.example.com/webhooks/orders", "format": "JSON" } } ``` Webhook endpoint update from `references/webhooks.md:251-278`: ```graphql ## Update Webhook mutation UpdateWebhook($id: ID!, $webhookSubscription: WebhookSubscriptionInput!) { webhookSubscriptionUpdate(id: $id, webhookSubscription: $webhookSubscription) { webhookSubscription { id endpoint { ... on WebhookHttpEndpoint { callbackUrl } } } userErrors { field message } } } ``` ```json { "id": "gid://shopify/WebhookSubscription/123", "webhookSubscription": { "callbackUrl": "https://myapp.example.com/webhooks/orders/v2" } } ``` The same file also provides creation mutations for filtered HTTP webhooks, field-selected webhooks, metafield-enabled webhooks, Google Pub/Sub destinations, and AWS EventBridge destinations. ### Technical Analysis Shopify webhooks create persistent, asynchronous data flows that continu ...[truncated 2287 chars]
• Remediation: ## Remediation Suggestions 1. Require explicit confirmation before creating any webhook or changing its topic, endpoint, filters, selected fields, metafield namespaces, or format. 2. Present the complete subscription plan before approval: - Webhook topic. - Destination URL, Pub/Sub project and topic, or EventBridge ARN. - Included fields and metafield namespaces. - Filters and payload format. - Data sensitivity and persistence. 3. Require the user to attest that they control and authorize the destination. 4. Restrict HTTP callbacks to HTTPS and enforce an approved-domain allowlist where practical. 5. Resolve and reject loopback, private, link-local, metadata-service, and otherwise prohibited network destinations. 6. Apply data minimization by requiring filters and the smallest necessary `includeFields` set. 7. Re-query the created or updated subscription and show the effective destination and topic to the user. 8. Log webhook creation and update approvals, target destinations, subscription IDs, and initiating identities. 9. Periodically enumerate subscriptions and alert on unknown destinations or unexpected topic changes. 10. Treat webhook creation and update as at least as sensitive as deletion in the Skill's central permission policy.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (30)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The skill is configured to activate for very broad Shopify-related requests, including 'any other Shopify store operations,' which can cause it to engage on ambiguous prompts and steer the agent toward powerful store-management actions. In a skill backed by an Admin API with destructive and financial capabilities, unintended invocation increases the chance of over-privileged use, mistaken mutations, or disclosure of sensitive store data.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation includes a blog deletion mutation with no warning that the action is destructive and may permanently remove store content. In a skill designed to manage Shopify content, omission of confirmation or rollback guidance increases the risk that an agent or user will execute irreversible deletions unintentionally.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The article deletion example documents permanent content removal without any warning about data loss, review requirements, or confirmation safeguards. Because this skill is for live Shopify store administration, an agent could treat deletion as routine and remove published business content accidentally or through prompt manipulation.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation provides ready-made bulk export examples for orders and customers, including customer identifiers and email address fields, but gives no warning about handling sensitive or regulated data. In a skill specifically designed to query and manage Shopify stores, this omission increases the likelihood that downstream agents or users will export personal and transactional data broadly without applying minimization, consent, retention, or secure-storage controls.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The bulk mutation section shows how to perform large-scale product updates through JSONL input without any warning about validation, review, rollback, or irreversible wide-impact changes. In an operational Shopify management skill, this can enable accidental or unsafe mass modification of store data, causing widespread integrity and business-impact issues if inputs are wrong or maliciously prepared.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This documentation exposes customer-focused GraphQL operations that retrieve and modify personally identifiable information, including email addresses, phone numbers, physical addresses, and order history, without any warning about sensitive-data handling, least-privilege access, or privacy/compliance considerations. In a skill explicitly designed to manage Shopify stores, this omission increases the likelihood of unsafe use, over-collection, and accidental disclosure of customer data.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This markdown file includes create and update discount operations that can change live pricing behavior, discount availability, or eligibility rules for customers. While activation, deactivation, and deletion are explicitly marked as requiring permission, the create and update sections omit comparable warnings despite having business-impacting effects.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This markdown file includes a `Delete Files` mutation example that removes file records, but it does not include any warning, confirmation guidance, or note that deletion may be irreversible. For markdown files, destructive behaviors that could affect user data should be explicitly disclosed to the user.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The release-hold mutation resumes order processing and can immediately re-enable shipment workflows, yet this section lacks the same explicit confirmation warning used for other operationally sensitive fulfillment actions. In an agent context, inconsistent warning coverage increases the chance the tool executes a state-changing action without deliberate user approval, causing unintended shipments or downstream customer-impacting changes.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Moving a fulfillment order to a different location materially changes inventory allocation, routing, and fulfillment responsibility, but this mutation is documented without an explicit user-warning or confirmation protocol. In a Shopify admin skill, that omission is risky because an autonomous or semi-autonomous agent may treat the operation as routine and perform disruptive logistics changes without informed approval.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill exposes `giftCardSendNotificationToCustomer` and `giftCardSendNotificationToRecipient` without the same explicit confirmation and impact warnings used for balance-changing or irreversible gift card operations. While these mutations do not directly move funds, they can trigger unintended external communications, leak the existence of a gift card workflow to recipients, and cause privacy, spam, or social-engineering issues if invoked without clear user approval.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation includes a location deletion mutation without clearly warning that deleting a Shopify location is a destructive administrative action that can disrupt fulfillment, inventory management, and operational continuity. In a skill designed to manage live Shopify store data, omission of an explicit caution increases the chance that an agent or user invokes deletion casually or without validating business impact.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The file documents a destructive deletion mutation for external marketing activities without any warning, confirmation guidance, or note about reversibility. In an agent skill that can directly operate against the Shopify Admin API, this increases the chance that an agent or operator will invoke permanent state-changing actions casually, causing unintended data loss or disruption of marketing operations.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: This example documents bulk deletion of marketing engagements by channel handle without warning about scope, permanence, or review steps. Because the operation can remove many records at once, an agent using this skill could cause significant analytics and attribution data loss from a single mistaken or manipulated call.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The customer email and SMS marketing consent update examples show direct mutation of consent state without any privacy, legal, or audit warning. In a skill that manages real customer records, this can enable unlawful subscription changes, compliance violations, and customer harm if an agent updates consent without verified authorization and recordkeeping.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| Level | Description |
|-------|-------------|
| `SINGLE_OPT_IN` | Subscribed without confirmation |
| `CONFIRMED_OPT_IN` | Subscribed with email/SMS confirmation |
| `UNKNOWN` | Opt-in level not specified |

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation includes a direct `marketDelete` mutation example without any warning that it is destructive, irreversible in practice, or should require explicit user confirmation before use. In an agent skill that operationalizes Shopify Admin actions, this increases the chance an agent or operator will execute tenant-impacting deletions casually or automatically, causing configuration loss and storefront disruption.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation includes a direct menu deletion mutation but provides no warning that the operation is destructive, irreversible in practice, or should require explicit user confirmation before execution. In an agent skill that manages live Shopify store data, this increases the chance that an automated workflow or user prompt could delete production navigation unintentionally, causing storefront disruption and business impact.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation includes a destructive metafield definition delete operation, including the option to delete all associated metafields, without warning that data removal may be irreversible and affect live store behavior or integrations. In a Shopify admin skill, omission of such cautions materially increases the chance that an agent or user will invoke the mutation casually and cause unintended data loss.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The metaobject delete and bulk delete examples document content-removal operations without warning that they delete stored structured content and may be difficult or impossible to recover. Because this skill is specifically for managing Shopify store data, these examples are more dangerous than generic API docs: an automated agent could treat them as routine operations and remove production content at scale.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This markdown file documents a `Delete Page` mutation that removes storefront pages, but it does not include any user warning about the destructive nature of the action, possible impact on published content, or whether deletion is reversible. For markdown files, operations affecting user data or system integrity should include explicit warnings when such risks are present.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The file documents a `Delete Segment` mutation but does not include any warning that this operation removes a customer segment and may affect targeting or downstream workflows. For markdown files, destructive or system-impacting behaviors should be disclosed so users understand the consequence before using the skill.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The skill description includes queries that retrieve segment members' names, email addresses, spending, and order counts, but it does not warn that these operations access potentially sensitive customer data. For markdown files, behaviors affecting user data or privacy should be explicitly disclosed.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The update examples show how to create and modify zones, rates, and product associations in live delivery profiles but provide no warning that these changes can immediately affect customer shipping charges and product deliverability. In an agent skill meant to manage Shopify stores, this raises the chance of unsafe automation or accidental production changes.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The file documents deletion of delivery profiles without any caution about business impact, confirmation requirements, or rollback considerations. In a Shopify admin context, removing shipping profiles can disrupt checkout availability, alter rates for live products, and cause operational outages if an agent executes the example blindly.

Static analysis

No suspicious patterns detected.