T09 · Insecure Skill Coding Practices
Error
- Location
shopify-admin.sh:7- Finding
Shopify access token can be transmitted to an untrusted host
- Content
View full analysis
&2 exit 1 fi API_BASE="https://${SHOPIFY_STORE_DOMAIN}/admin/api/2026-01" AUTH_HEADER="X-Shopify-Access-Token: ${SHOPIFY_ACCESS_TOKEN}" ``` ### Technical Analysis The script checks only that `SHOPIFY_STORE_DOMAIN` is nonempty. It does not verify that the value is a legitimate Shopify hostname or the specific store authorized to receive the access token. Every supported operation constructs its URL from `API_BASE` and sends `AUTH_HEADER` to that destination. Consequently, anyone who can influence the process or gateway environment can direct the request to an attacker-controlled HTTPS host and receive the Shopify Admin API token in the `X-Shopify-Access-Token` header. Allowing the Shopify store to be configured is necessary for the declared functionality, but allowing an unrestricted credential destination exceeds that requirement. ### Attack Path 1. An attacker gains the ability to influence the agent or gateway environment, deployment configuration, or command execution context. 2. The attacker sets `SHOPIFY_STORE_DOMAIN` to an HTTPS hostname under their control. 3. A user or agent invokes any command, such as `shop`, `orders`, or `products`. 4. The script constructs an API URL using the malicious hostname. 5. `curl` connects to that host and includes the victim's Shopify token in the request header. 6. The attacker captures the token and uses it directly against the legitimate Shopify Admin API. ### Impact Asses ...[truncated 370 chars]- Remediation
View remediation
&2 exit 1 ;; *.myshopify.com) ;; *) echo "Error: Store domain must be an approved myshopify.com hostname." >&2 exit 1 ;; esac ``` An exact hostname allowlist is safer than a suffix check whenever the deployment targets only one store. ]]>