Security audit

Universal Product Search

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently performs product search through Shopify's UCP CLI and does not show hidden purchasing, credential theft, destructive behavior, or unrelated access.

Before installing, understand that searches will be sent through the Shopify UCP CLI and that the first run may download that CLI with npx if it is not already installed. Use it for product research, not purchasing, and avoid entering sensitive information into product search queries.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/search.mjs:86