ClawHub
Back to skill

Security audit

Shopify MCP

Security checks for vulnerabilities and agentic risk

Overview

This Shopify MCP skill is coherent for store administration, but it asks users to run unpinned third-party code with powerful Shopify credentials and lacks clear safeguards for high-impact store changes.

Review before installing. Use a pinned and audited shopify-mcp revision, lock dependencies, protect the Shopify token as a secret, grant only the scopes you need, and require explicit confirmation before any order cancellation, fulfillment, customer update, or inventory change.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
SKILL.md:20
Finding

Unpinned Third-Party Repository and Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20–22
Vulnerability Type: Unverified third-party source and dependency installation
Risk Level: High

bash
git clone https://github.com/dzunglaviet/shopify-mcp
cd shopify-mcp
python3 -m venv venv
venv/bin/pip install -r requirements.txt

Technical Analysis

The installation procedure clones the mutable default branch of a third-party Git repository without pinning a reviewed commit or signed release. It also installs all packages specified by the remotely supplied requirements.txt without documented version locks, package hashes, signature verification, or source validation.

Consequently, the code installed by users can differ from the code that was originally reviewed. A compromise of the upstream repository, its maintainer account, its dependency definitions, or a transitive package could introduce arbitrary Python code. The configured MCP server is subsequently executed locally and receives access to a sensitive Shopify Admin API token.

This issue is classified as insecure dependency handling because the Skill establishes an unverified software supply chain and instructs users to execute its output in a privileged operational context.

Attack Path

  1. An attacker compromises the referenced repository, a maintainer account, or one of the Python packages resolved through requirements.txt.
  2. The attacker adds malicious code to the default branch or publishes a malicious dependency version accepted by the dependency specification.
  3. A user follows the documented setup procedure and clones the mutable repository.
  4. The user runs pip install -r requirements.txt, causing package installation logic or malicious dependencies to execute locally.
  5. The user configures and starts the downloaded MCP server through Claude Code or OpenClaw.
  6. The malicious component reads the Shopify token from the process environment or .env file and may access local files available to th ...[truncated 870 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the upstream source to a specific, reviewed commit hash or cryptographically signed release instead of cloning a mutable default branch.
  2. Verify the downloaded source using a documented checksum or signature before installation.
  3. Pin every direct and transitive Python dependency to an exact reviewed version.
  4. Generate and enforce hashes for dependencies, such as with a locked requirements file and pip install --require-hashes.
  5. Use a trusted private package mirror or another controlled dependency source where feasible.
  6. Audit and vendor the MCP server source into the Skill package when practical so that the executed implementation is included in the security review.
  7. Run the server under a dedicated, restricted operating-system account or sandbox with minimal filesystem and network access.
  8. Grant only the Shopify API scopes required for the intended operations rather than enabling all documented write scopes by default.
  9. Store the Shopify token in an operating-system secret manager or protected credential store, restrict file permissions if .env must be used, and rotate the token after any suspected compromise.
  10. Document the verified repository revision and dependency lock-file update process so future changes require security review before deployment.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md
Manage your Shopify store directly from Claude / OpenClaw — orders, customers, products, and inventory — using natural language.

Powered by [shopify-mcp](https://github.com/dzunglaviet/shopify-mcp), a Python MCP server connecting to the Shopify Admin REST API. Supports multiple stores, static access tokens, and OAuth client credentials.

## Tools

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

3. Configure .env

bash
cp .env.example .env

Fill in your credentials:

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

4. Add to Claude Code / OpenClaw

Add to ~/.claude/settings.json:

json
{

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

venv/bin/pip install -r requirements.txt

text

### 2. Create a Shopify Custom App

1. Shopify Admin → Settings → Apps → **Develop apps** → Create an app
2. **Configuration → Admin API scopes** — enable:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The instructions tell users to place a Shopify access token in a local .env file without any warning about the sensitivity of that credential or how to protect it. This increases the risk of accidental disclosure through source control, backups, logs, screenshots, or permissive filesystem access, which could grant broad administrative access to the store.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill exposes high-impact actions such as canceling orders, fulfilling orders, and modifying inventory through natural-language prompts, but provides no guidance to require explicit confirmation before execution. In an agentic context, ambiguous or mistaken user prompts can easily trigger irreversible business actions affecting customers, stock levels, and order processing.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:43