Security audit
Security checks for vulnerabilities and agentic risk
The skill’s dropshipping features are disclosed and require approval for account changes, with practical cautions around customer photos, listing cleanup, and payment tests.
Review the exact products, prices, and orders before approving changes. Redact unnecessary customer information from supplier evidence, and preserve useful sizing, safety, and store-language text during cleanup. Prefer payment test mode and pause automatic fulfillment during testing; [Shopify’s testing guidance](https://help.shopify.com/en/manual/checkout-settings/test-orders/processing-test-order) explains live-payment fees and fulfillment precautions. Keep export backups and complete sign-in through OAuth.
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
}
**Gemini CLI**: add the server to `~/.gemini/settings.json`, then run `/mcp auth dsers`.
```json
{
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## Rules
- Never ask for or accept a DSers password, verification code, API key, access token, or browser cookie. If the user pastes one, tell them not to share it and continue without using it.
- Do not say DSers is connected until a DSers tool call has succeeded in this conversation.
- Until then, do not present any store, product, order, price, or status as the user's DSers data. Offer to continue as soon as the connection works.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
**With DSers connected.** DSers tools are available in this conversation; some apps show them with a prefix, such as `mcp__dsers__`. Use them for live data: supplier search, supplier product details, shipping costs, the user's stores, Import List products, and pricing rules. For supplier and product data, use them instead of web search. Each DSers tool's description gives its arguments, limits, and confirmation requirements; follow it.
Check which way applies by looking for DSers tools in this conversation. When you can see them, do not ask the user whether DSers is connected.
## DSers and DSers MCP
Requiring a completed and refunded test order without distinguishing test mode from live payment can cause unnecessary charges, retained processing fees, or automatic fulfillment. The separate approval requirement reduces unauthorized-action risk but does not ensure the user understands these consequences.
The unconditional removal of Chinese text conflicts with collecting the store's language and can delete legitimate descriptions, sizing information, or warnings for Chinese-language storefronts. Batch CSV updates could spread this content-integrity error across many products, although previews, approval, and backups reduce the risk.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
## United States
**Shipping on time.** Under the FTC Mail, Internet, or Telephone Order Merchandise Rule, a seller needs a reasonable basis for the shipping time it states, and must ship within 30 days when it states none. If the seller cannot ship on time, it must ask for the customer's consent to the delay. Without consent, it must cancel and refund all money paid for the unshipped item, without being asked. If the new date is 30 days or less, the delay notice may say that no reply counts as consent; if the new date is later or unknown, the order is cancelled automatically at the original promised time plus 30 days unless the customer agrees. Refunds are due within seven working days after cancellation for card payments and most other methods (one billing cycle only where the seller itself extended the credit).
Source: https://www.ftc.gov/business-guidance/resources/business-guide-ftcs-mail-internet-or-telephone-order-merchandise-rule
**"Was" prices.** Under the FTC Guides Against
The workflow collects shipping-label photos and then directs using those photos in a supplier dispute without requiring redaction or limiting disclosure. Labels can expose customer names, addresses, phone numbers, and tracking identifiers to supplier personnel who may not need all of that information.