Shopify Checkout & Payment Connection Check

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:37 AM UTC
• Version: 1.0.0

Overview

This Shopify checkout audit skill is mostly read-only and purpose-aligned, but it deserves Review because an optional CLI path can run arbitrary local JavaScript and the secret-bearing env file is not forced to owner-only permissions.

Install only if you trust the local working directory and env file. Do not set SKILL_HUB_SHOPIFY_CLI_JS unless it points to a verified Shopify CLI file you control, keep skill-hub.env outside the skill folder and out of Git, and restrict its permissions before adding Shopify client secrets or automation tokens.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T07 · Tool Hijacking and Spoofing

Warning

• Location: scripts/checkout-admin-read.mjs:120

Finding

Configurable JavaScript Entry Point Allows Shopify CLI Tool Hijacking

Content

View full analysis

true).catch(() => false); if (!exists) throw new Error("CLI_NOT_FOUND: SKILL_HUB_SHOPIFY_CLI_JS does not point to a readable file."); return { command: process.execPath, prefix: [explicit] }; } ``` ### Technical Analysis The `SKILL_HUB_SHOPIFY_CLI_JS` configuration value is treated as the path to a JavaScript executable. The application verifies only that the specified file is readable and then launches it through the current Node.js runtime. The code does not verify that the file belongs to an authentic Shopify CLI installation, resides in a trusted directory, has an expected integrity hash, or corresponds to an approved package and version. Consequently, configuration data can select arbitrary JavaScript for execution. The use of `execFile` elsewhere avoids shell metacharacter injection, but it does not mitigate replacement of the executable payload itself. This is a tool-spoofing risk rather than conventional shell injection. ### Attack Path 1. An attacker gains the ability to modify the working-directory `skill-hub.env` file or the inherited process environment. 2. The attacker creates a malicious JavaScript file readable by the agent process. 3. The attacker sets `SKILL_HUB_SHOPIFY_CLI_JS` to the malicious file path. 4. A user runs `connection-check` or `collect` in Shopify CLI mode. 5. `cliInvocation()` accepts the file based solely on readability. 6. The application launches the malicious file using `process.execPath`. 7. The substituted program executes with the privileges and environment of the Skill process while appearing to be the configured Shopify CLI. ...[truncated 965 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/checkout-admin-read.mjs:261

Finding

Secret-Bearing Environment File Is Created Without Explicit Restrictive Permissions

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/onboarding-guide.md (reported line 13)May include surrounding context.

md

### Quick connection (recommended)

Use this for a first run or occasional work. The merchant supplies a store address, never an access token or API secret.

1. Ensure Shopify CLI 3.93.0+ is available.
2. Create private `skill-hub.env` in the merchant's working directory with the skill's `init-env` command. Keep it ignored by Git; never place it in the skill folder.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/onboarding-guide.md (reported line 48)May include surrounding context.

md

### Quick connection (recommended)

Use this for a first run or occasional work. The merchant supplies a store address, never an access token or API secret.

1. Ensure Shopify CLI 3.93.0+ is available.
2. Create private `skill-hub.env` in the merchant's working directory with the skill's `init-env` command. Keep it ignored by Git; never place it in the skill folder.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill requires environment variables containing sensitive Shopify connection details and instructs use of a Node script that performs network access, but it does not declare an explicit tool scope such as permissions or allowed-tools. That mismatch weakens policy enforcement and reviewability: a runtime may grant broader capabilities than are obvious from the manifest, increasing the chance of unintended secret exposure or external access if the skill is modified or misused.

Content

No source excerpt is available for this finding.

Dynamic Request Target

Medium

• Category: Server-Side Request Forgery
• Confidence: 60% confidence

Finding

Request target host is built from a dynamic or untrusted value. If the host is attacker-influenced, this enables SSRF to arbitrary internal or metadata endpoints.

Content

Scanner excerpt · scripts/checkout-admin-read.mjs (reported line 160)May include surrounding context.

js

const cacheKey = `${config.storeDomain}:${clientId}`;
  const cached = tokenCache.get(cacheKey);
  if (cached && cached.expiresAt > Date.now() + 60_000) return cached;
  const response = await fetch(`https://${config.storeDomain}/admin/oauth/access_token`, {
    method: "POST",
    headers: { "Content-Type": "application/x-www-form-urlencoded" },
    body: new URLSearchParams({ grant_type: "client_credentials", client_id: clientId, client_secret: clientSecret }),

Dynamic Request Target

Medium

• Category: Server-Side Request Forgery
• Confidence: 60% confidence

Finding

Request target host is built from a dynamic or untrusted value. If the host is attacker-influenced, this enables SSRF to arbitrary internal or metadata endpoints.

Content

Scanner excerpt · scripts/checkout-admin-read.mjs (reported line 193)May include surrounding context.

js

const cacheKey = `${config.storeDomain}:${clientId}`;
  const cached = tokenCache.get(cacheKey);
  if (cached && cached.expiresAt > Date.now() + 60_000) return cached;
  const response = await fetch(`https://${config.storeDomain}/admin/oauth/access_token`, {
    method: "POST",
    headers: { "Content-Type": "application/x-www-form-urlencoded" },
    body: new URLSearchParams({ grant_type: "client_credentials", client_id: clientId, client_secret: clientSecret }),

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · references/api-surfaces.md (reported line 3)May include surrounding context.

md

# API surfaces and interpretation

Use only the approved read-only surfaces below. Do not expand scopes silently.

## Store connection

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/checkout-admin-read.mjs:99

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/onboarding-guide.md:45