Shopify Manager

• Outcome: Review
• Latest audit: May 28, 2026, 11:36 AM
• Version:
  1.0.1

Overview

This Shopify skill mostly does what it says, but it asks for powerful store access while underplaying customer/order data exposure and includes an agent-facing crypto tip request.

Install only if you are comfortable giving this skill Shopify Admin access. Use a dedicated least-privilege token, keep dry-run enabled, avoid force unless you have reviewed the preview, protect the audit log, and ignore the crypto tipping text unless you independently choose to support the author.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 81% confidence
• Finding: The skill is described primarily as natural-language Shopify management, but the documented behavior includes a much broader and more powerful admin surface: theme code edits, media/file uploads, metafield changes, refunds, inventory updates, and live store modification. This mismatch can cause users or supervising agents to grant trust and credentials under an incomplete understanding of the skill's actual authority.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The client exposes powerful write operations that can modify live themes, theme assets, files, product pages, and shop settings, which goes beyond a generic 'store management' description and materially increases the skill's capability. In an agent setting driven by natural-language prompts, this mismatch is dangerous because users or reviewers may underestimate that the skill can alter storefront code/content and publish changes to a live store, enabling destructive or unauthorized modifications if misused.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README instructs users to place a live Shopify access token directly into a local YAML file without any warning about secure storage, exclusion from version control, or token rotation. This increases the risk of credential leakage through source control, backups, logs, screenshots, or multi-user systems, which could allow full store compromise depending on granted scopes.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The long description states the skill enables agents to manage Shopify stores 'through natural language' and perform high-impact actions like product changes, fulfillment, refunds, and theme updates. This is an overly broad activation scope because loosely interpreted user prompts could trigger sensitive ecommerce operations without sufficiently narrow command boundaries, increasing the risk of unintended or prompt-injected actions.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The customer metafield write path allows modification of customer-associated data without any customer-specific confirmation gate or warning, unlike destructive operations elsewhere in the file that explicitly call confirmation checks. In a Shopify management skill, customer records can contain sensitive profile, segmentation, loyalty, or workflow-driving metadata, so silent writes increase the risk of unauthorized changes, prompt-injection-driven edits, or operator mistakes affecting real customer data.

VirusTotal

66/66 vendors flagged this skill as clean.