Shopify Store Management via Agiexa

• Outcome: Pass
• Latest audit: Oct 29, 2026 · 3:59 PM UTC
• Version: 1.0.3

Overview

This skill currently previews future Shopify features and offers a disclosed, opt-in waitlist signup.

Expect feature information and optional waitlist signup from this version. Signup sends your email, role, and any optional URL or message to Agiexa. The advertised live management capabilities and service security protections are not implemented or independently verified by these files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied code only submits a waitlist entry. It does not access Shopify or perform any of the declared management operations. Waitlist enrollment is a materially different primary purpose, not an implementation detail of the described functionality. The submitted values are hard-coded examples; the code does not demonstrate collecting actual user information or obtaining merchant approval.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/tools.md (reported line 45)May include surrounding context.

md

| `SHOPIFY_CREATE_CUSTOMER` | Create a new customer in Shopify |
| `SHOPIFY_CREATE_CUSTOMER_ACCOUNT_ACTIVATION_URL` | Generate a one-time account activation URL for a customer whose account is in 'disabled' state (not yet activated) |
| `SHOPIFY_CREATE_CUSTOMER_ADDRESS` | Create a new address for a customer |
| `SHOPIFY_CREATE_DELEGATE_ACCESS_TOKEN` | Create a delegate access token with a subset of the parent token's permissions |
| `SHOPIFY_CREATE_DISCOUNT_CODE` | Creates a discount code for an existing price rule |
| `SHOPIFY_CREATE_DISCOUNT_CODE_BATCH` | Create a discount code creation job for batch processing |
| `SHOPIFY_CREATE_DRAFT_ORDER` | Create a draft order in Shopify |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/tools.md (reported line 70)May include surrounding context.

md

| `SHOPIFY_CREATE_SCRIPT_TAG` | Create a new script tag in Shopify to load remote JavaScript into your online store |
| `SHOPIFY_CREATE_SMART_COLLECTIONS` | Create a new smart collection with automated product rules |
| `SHOPIFY_CREATES_OR_UPDATES_AN_ASSET_FOR_A_THEME` | Creates or updates a theme asset file (templates, stylesheets, scripts, or images) within a Shopify theme |
| `SHOPIFY_CREATE_STOREFRONT_ACCESS_TOKEN` | Creates a new storefront access token for unauthenticated Storefront API access |
| `SHOPIFY_CREATE_THEME` | Creates a new theme in Shopify from a ZIP file containing theme assets |
| `SHOPIFY_CREATE_WEBHOOK_SUBSCRIPTION` | Create a webhook subscription that notifies your app when specific events occur in a Shopify store |
| `SHOPIFY_DELETE_ARTICLE` | Delete an article from a blog in Shopify |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/tools.md (reported line 98)May include surrounding context.

md

| `SHOPIFY_DELETES_A_DISCOUNT_CODE` | Delete a discount code from a price rule |
| `SHOPIFY_DELETE_SAVED_SEARCH` | Delete a saved search in Shopify |
| `SHOPIFY_DELETE_SMART_COLLECTION` | Permanently removes a smart collection from a Shopify store using its `smart_collection_id`; this action is irreversible and requires a valid, existin |
| `SHOPIFY_DELETE_STOREFRONT_ACCESS_TOKEN` | Delete an existing storefront access token from a Shopify store |
| `SHOPIFY_DELETE_THEME` | Deletes a theme from the Shopify store by its ID |
| `SHOPIFY_DELETE_THEME_ASSET` | Delete an asset from a Shopify theme |
| `SHOPIFY_DELETE_WEBHOOK_SUBSCRIPTION` | Delete a webhook subscription and stop all future webhooks to its endpoint |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/tools.md (reported line 107)May include surrounding context.

md

| `SHOPIFY_ENABLE_STANDARD_METAOBJECT_DEFINITION` | Enable a standard metaobject definition from its template |
| `SHOPIFY_GET_ABANDONMENT` | Retrieves an abandonment record from Shopify using its unique ID |
| `SHOPIFY_GET_ABANDONMENT_BY_ABANDONED_CHECKOUT_ID` | Query abandonment information by abandoned checkout ID using Shopify's GraphQL Admin API |
| `SHOPIFY_GET_ACCESS_SCOPES` | Retrieves a list of access scopes associated with the access token |
| `SHOPIFY_GET_APP` | Query information about a Shopify app using the GraphQL API |
| `SHOPIFY_GET_APP_BY_HANDLE` | Query app information by handle using the Shopify Admin GraphQL API |
| `SHOPIFY_GET_APP_INSTALLATION` | Query a specific app installation on a Shopify store |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/tools.md (reported line 197)May include surrounding context.

md

| `SHOPIFY_GET_SMART_COLLECTION_BY_ID` | Retrieve a single smart collection by its ID |
| `SHOPIFY_GET_SMART_COLLECTIONS` | Retrieve a list of smart collections from a Shopify store |
| `SHOPIFY_GET_SMART_COLLECTIONS_COUNT` | Retrieve a count of smart collections in a Shopify store |
| `SHOPIFY_GET_STOREFRONT_ACCESS_TOKENS` | Retrieves a list of storefront access tokens that have been issued for the shop |
| `SHOPIFY_GET_TENDER_TRANSACTIONS` | Retrieve a list of tender transactions from Shopify |
| `SHOPIFY_GET_THEME` | Retrieves a single Shopify theme by its unique ID |
| `SHOPIFY_GET_THEMES` | Retrieves a list of themes from a Shopify store |

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md

openclaw:
    requires:
      bins:
        - curl
    homepage: https://agiexa.com/integrations/shopify
---

The manifest advertises operational Shopify management, but the skill defers all management tasks and implements waitlist enrollment instead.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The manifest at L003 presents the skill as providing Shopify management through 315 tools, including managing orders, products, and inventory. However, L081 explicitly instructs the agent not to perform those tasks because the capabilities are unavailable until November 2026; the executable workflow instead submits user contact details to a waitlist endpoint at L098. This is a substantive mismatch between the advertised functionality and the skill's current behavior, even though waitlist submission requires consent.

Content

No source excerpt is available for this finding.