Shopify Category Collector

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:23 PM UTC
• Version:
  1.0.0

Overview

This is a disclosed Shopify category-scraping tool that saves local CSV and screenshot outputs, with ordinary privacy and npm dependency cautions.

Install only from the reviewed package and lockfile, use a trusted npm registry, and run it only against sites you are authorized to crawl. Choose an output directory deliberately, and avoid running it while authenticated to sensitive storefront/admin views because the saved homepage screenshot may capture visible page state.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Description-Behavior Mismatch

Low

• Confidence: 94% confidence
• Finding: The script saves a full-page screenshot of the visited homepage even though the stated purpose is only to collect category links into CSV. Screenshots can capture unrelated sensitive or proprietary content such as account state, banners, embedded customer data, or internal/admin UI elements if the operator runs it while authenticated, creating unnecessary data collection and retention risk.

Known Vulnerable Dependency: playwright==1.40.0 — 1 advisory(ies): CVE-2025-59288 (Playwright downloads and installs browsers without verifying the authenticity of)

High

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: playwright==1.40.0

VirusTotal

64/64 vendors flagged this skill as clean.