Security audit

optimize-shopify-alt-text

Security checks across malware telemetry and agentic risk

Overview

This skill is coherent for Shopify alt text auditing and updates, but it requires Shopify write access and careful preview review before execution.

Install only if you are comfortable granting Shopify read/write scopes for product media, files, collections, and article content. Prefer the short-lived Shopify CLI connection unless you truly need a long-running trusted connection, keep credentials in the private env file, provide a .myshopify.com or Shopify admin URL, and review the preview plan before allowing --execute.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The script invokes external system commands to discover and drive the Shopify CLI via npm and node. While likely intended for legitimate Shopify administration, spawning external binaries expands the trust boundary and execution surface beyond simple alt-text processing; a malicious or tampered CLI path or globally installed package could cause unintended code execution under the user's privileges.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The function accepts merchant-supplied URLs/domains and performs outbound fetches to arbitrary hosts to infer the permanent Shopify domain. This creates an SSRF-like network primitive and broadens behavior beyond the stated purpose, allowing connections to attacker-controlled hosts and potential internal network probing if the input is not tightly constrained.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The apply path can perform write operations that modify product media, collection images, and article content when --execute is provided, but there is no final interactive confirmation or explicit warning at execution time. In an agentic setting, this increases the chance of accidental destructive or bulk unauthorized changes if a plan is wrong, stale, or maliciously crafted.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/lib/shopify-dev-dashboard-auth.mjs:17

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/onboarding-guide.md:45