ClawHub
Back to skill

Security audit

Shopify Localization & Markets Auditor

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate Shopify auditing skill, but it needs review because it requests store-changing permissions and can execute live Shopify configuration changes from a fix-plan file.

Install only for a Shopify store you control and only if you are comfortable granting write-level Shopify permissions. Use the preview command first, inspect the generated fix plan, and run --execute only after confirming each proposed locale or currency change is intended.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
This skill is described as an auditor, but it also contains an `apply` path that can perform live Shopify mutations such as enabling/publishing locales and changing market currency settings. That creates integrity risk because an operator may invoke a tool they believe is read-only and unintentionally alter production storefront configuration.

Natural-Language Policy Violations

Medium
Confidence
88% confidence
Finding
The rule instructs the skill to render reports automatically in the conversation or machine locale without requiring explicit user choice. That can cause the agent to infer and act on locale-related signals the user did not intentionally provide, which creates privacy and consent concerns and can produce incorrect or unwanted language output in multilingual or shared-device contexts.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
? { title: action.title, status: "VERIFIED" }
      : { title: action.title, status: "NOT_VERIFIED", reason: "Local currencies are not enabled after the mutation." };
  }
  return { title: action.title, status: "SKIPPED", reason: "No verification rule for this action." };
}

async function cmdApply(args) {
Confidence
79% confidence
Finding
The skill can autonomously execute a batch of write actions from an input JSON when `--execute` is supplied, and those actions mutate live Shopify configuration. Although there is a preview mode, there is no cryptographic binding, allowlist, or interactive confirmation ensuring the executed plan is the one the user reviewed, so a tampered fix-plan file or unsafe upstream generation could cause unauthorized configuration changes.

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/lib/shopify-dev-dashboard-auth.mjs:4

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
references/onboarding-guide.md:45