Security audit

shopify-operations-brief

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed, read-only Shopify reporting tool that uses store credentials only to generate private operations reports.

Install only if you are comfortable granting read-only Shopify access to orders, products, inventory, discount, fulfillment, and aggregate customer/order context. Keep the env file and generated HTML reports private, use the smallest read-only scopes, and avoid the Admin API token mode unless you intentionally created a local read-only token for this use.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: tests/test-shopify-operations-brief.mjs:134