Security audit

WeChat to Shopify Blog

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent Shopify blog-draft workflow, with sensitive Shopify access disclosed and used for the stated draft and related-product features.

Install only for a store where you are comfortable letting the agent read blog content, files, and product catalog details, including pricing, SEO, media, tags, and collections. Keep client credentials private, prefer the quick Shopify CLI browser connection unless a long-running trusted agent is needed, and review the draft plan before allowing any --execute write step.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The GraphQL context query collects the full shop profile, blog list, recent articles, and a paginated product catalog with descriptions, SEO metadata, collections, media, pricing, tags, and store URLs. For a skill whose stated purpose is converting a WeChat article into a Shopify blog draft, this exceeds least-privilege data access and creates unnecessary exposure of commercially sensitive catalog data.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The context command loops through paginated product results and prints the entire catalog dataset to stdout, turning the skill into a bulk product-introspection utility. In an agent setting, this broadens the blast radius because an invocation intended for blog drafting can also exfiltrate store inventory, pricing, SEO, and collection data unrelated to the article task.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/lib/shopify-dev-dashboard-auth.mjs:4

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/onboarding-guide.md:45