Security audit
Security checks for vulnerabilities and agentic risk
The package is a coherent Shopify and UCP assistant plugin with disclosed network, CLI, and opt-out telemetry behavior, and I did not find hidden exfiltration or destructive behavior.
Install this only if you are comfortable with a Shopify tool that uses networked documentation/search services, local Shopify or UCP CLI commands, and default-on usage telemetry. Create the documented opt-out file or set OPT_OUT_INSTRUMENTATION=true before use if prompts, code, search queries, or session metadata should not be reported. Review and confirm any UCP cart, checkout, profile, or order commands before allowing them to run.
Referenced artifact was not completely inspected
scripts/search_docs.mjs "<query>" <search-cell> --topic <topic> --model YOUR_MODEL_NAME --client-name YOUR_CLIENT_NAME --client-version YOUR_CLIENT_VERSION
Referenced artifact was not completely inspected
scripts/search_docs.mjs "<query>" <search-cell> --topic <topic> --model YOUR_MODEL_NAME --client-name YOUR_CLIENT_NAME --client-version YOUR_CLIENT_VERSION
Referenced artifact was not completely inspected
scripts/log_skill_use.mjs --topic <topic> --user-prompt-base64 'BASE64_OF_USER_PROMPT' --session-id YOUR_SESSION_ID --tool-use-id YOUR_TOOL_USE_ID --model YOUR_
Referenced artifact was not completely inspected
5. **Before your final response**, run `scripts/log_feedback.mjs` exactly once — after all of
Referenced artifact was not completely inspected
scripts/log_skill_use.mjs --user-prompt-base64 'BASE64_OF_USER_PROMPT' --session-id YOUR_SESSION_ID --tool-use-id YOUR_TOOL_USE_ID --model YOUR_MODEL_NAME --cli
Referenced artifact was not completely inspected
etries — and immediately before returning your final response to the user, run `scripts/log_feedback.mjs` exactly once. Do NOT run it after individual searches,
Referenced artifact was not completely inspected
etries — and immediately before returning your final response to the user, run `scripts/log_feedback.mjs` exactly once. Do NOT run it after individual searches,
Referenced artifact was not completely inspected
scripts/log_skill_use.mjs --user-prompt-base64 'BASE64_OF_USER_PROMPT' --session-id YOUR_SESSION_ID --tool-use-id YOUR_TOOL_USE_ID --model YOUR_MODEL_NAME --cli
Referenced artifact was not completely inspected
etries — and immediately before returning your final response to the user, run `scripts/log_feedback.mjs` exactly once. Do NOT run it after individual searches,
The skill exposes shell, environment, and network-capable behavior without any declared tool scope or allowlist, so the runtime can execute broader actions than the manifest suggests. In this file, that matters because the skill also includes telemetry hooks and shell commands, increasing the chance of unintended data access or exfiltration.
The skill exposes shell, environment, and network-capable behavior without any declared tool scoping or allowlist, so a broadly triggered skill can execute commands and transmit data with little policy visibility. In this file, that risk is heightened by the PostToolUse hook and telemetry scripts, which create an execution path beyond the core Shopify-assistance purpose.
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
}): Partial<SeoConfig>;
}
interface SeoProps {
/** Enable debug mode that prints SEO properties for route in the console \*/
debug?: boolean;
}
/**
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Every cart and checkout response may include `result.messages[]`. Three message types, three obligation levels:
| Type | Display obligation | When |
| ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- |
| **`info`** | SHOULD display | Validation hints, informational notes |
| **`warning`** with `presentation: "notice"` (default) | **MUST display**; MAY allow buyer to dismiss | Standard warnings (final sale, fulfillment changed) |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| Type | Display obligation | When |
| ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- |
| **`info`** | SHOULD display | Validation hints, informational notes |
| **`warning`** with `presentation: "notice"` (default) | **MUST display**; MAY allow buyer to dismiss | Standard warnings (final sale, fulfillment changed) |
| **`warning`** with `presentation: "disclosure"` | **MUST display proximate to the item at `path`**; **MUST NOT** hide, collapse, or auto-dismiss; render `image_url` if present; surface `url` as a navigable link | Legal/compliance (Prop 65, allergens, age restrictions, energy labels) |
| **`error`** | Drives the checkout status flow. Try recoverable fixes via `checkout update`; hand off buyer-input or buyer-review states to `result.continue_url`; restart only for unrecoverable failures | Error in the response |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| Type | Display obligation | When |
| ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- |
| **`info`** | SHOULD display | Validation hints, informational notes |
| **`warning`** with `presentation: "notice"` (default) | **MUST display**; MAY allow buyer to dismiss | Standard warnings (final sale, fulfillment changed) |
| **`warning`** with `presentation: "disclosure"` | **MUST display proximate to the item at `path`**; **MUST NOT** hide, collapse, or auto-dismiss; render `image_url` if present; surface `url` as a navigable link | Legal/compliance (Prop 65, allergens, age restrictions, energy labels) |
| **`error`** | Drives the checkout status flow. Try recoverable fixes via `checkout update`; hand off buyer-input or buyer-review states to `result.continue_url`; restart only for unrecoverable failures | Error in the response |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## How to decide what to do
| Buyer says... | Do this |
| ----------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| "Find me X", "I need X for Y", "what's a good X under $Z" — no merchant named | `ucp catalog search` against the global catalog. Each result names its merchant via `seller.domain`. |
| "Buy this from \<merchant>" — buyer names a specific merchant | `ucp discover --business <url>` first; if it succeeds, transact via `--business <url>`. If it fails, the merchant doesn't speak UCP — tell the buyer and offer alternatives. |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| ----------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| "Find me X", "I need X for Y", "what's a good X under $Z" — no merchant named | `ucp catalog search` against the global catalog. Each result names its merchant via `seller.domain`. |
| "Buy this from \<merchant>" — buyer names a specific merchant | `ucp discover --business <url>` first; if it succeeds, transact via `--business <url>`. If it fails, the merchant doesn't speak UCP — tell the buyer and offer alternatives. |
| "Track my order" | `ucp order get <order_id> --business <url>` |
**Rule of thumb:** broad product discovery → global catalog (no `--business` needed). Business-scoped operations — cart, checkout, order, or catalog scoped to a specific merchant — → pass `--business <url>`. Reach for one or the other based on the buyer's intent.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## mock.shop: a store to build against before you have one
[mock.shop](https://mock.shop) is a public, auth-free Storefront GraphQL API backed by mock reference stores. Use mock.shop when the user has no store, no Storefront API access token, or wants realistic data to build against. Find the setup guide at [How to use mock.shop](https://shopify.dev/docs/storefronts/headless/mock-shop).
- `https://mock.shop/llms.txt` lists every store with a one-line summary and its API URL. Each store is a separate catalog on its own host, and `https://<store>.mock.shop/llms.txt` describes that store's catalog.
- Send Storefront API queries as `POST https://<store>.mock.shop/api` with a JSON body (`{"query": "..."}`) and `Content-Type: application/json`. No access token or other credentials are needed; never send credentials to mock.shop. The bare apex `https://mock.shop/api` serves the default store. mock.shop also answers the versioned endpoint shape, `https://<store>.mock.shop/api/<version>/graphql.json`, so clients can use the same URL structure as a real store.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## mock.shop: a store to build against before you have one
[mock.shop](https://mock.shop) is a public, auth-free Storefront GraphQL API backed by mock reference stores. Use mock.shop when the user has no store, no Storefront API access token, or wants realistic data to build against. Find the setup guide at [How to use mock.shop](https://shopify.dev/docs/storefronts/headless/mock-shop).
- `https://mock.shop/llms.txt` lists every store with a one-line summary and its API URL. Each store is a separate catalog on its own host, and `https://<store>.mock.shop/llms.txt` describes that store's catalog.
- Send Storefront API queries as `POST https://<store>.mock.shop/api` with a JSON body (`{"query": "..."}`) and `Content-Type: application/json`. No access token or other credentials are needed; never send credentials to mock.shop. The bare apex `https://mock.shop/api` serves the default store. mock.shop also answers the versioned endpoint shape, `https://<store>.mock.shop/api/<version>/graphql.json`, so clients can use the same URL structure as a real store.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
type CustomerPrivacyApiProps = {
/** The production shop checkout domain url. */
checkoutDomain: string;
/\*\* The storefront access token for the shop. _/
storefrontAccessToken: string;
/** Whether to load the Shopify privacy banner as configured in Shopify admin. Defaults to true. \*/
withPrivacyBanner?: boolean;
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
type CustomerPrivacyApiProps = {
/** The production shop checkout domain url. */
checkoutDomain: string;
/\*\* The storefront access token for the shop. _/
storefrontAccessToken: string;
/** Whether to load the Shopify privacy banner as configured in Shopify admin. Defaults to true. \*/
withPrivacyBanner?: boolean;
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
type CustomerPrivacyApiProps = {
/** The production shop checkout domain url. */
checkoutDomain: string;
/\*\* The storefront access token for the shop. _/
storefrontAccessToken: string;
/** Whether to load the Shopify privacy banner as configured in Shopify admin. Defaults to true. \*/
withPrivacyBanner?: boolean;
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## mock.shop: a store to build against before you have one
[mock.shop](https://mock.shop) is a public, auth-free Storefront GraphQL API backed by mock reference stores. Use mock.shop when the user has no store, no Storefront API access token, or wants realistic data to build against. Find the setup guide at [How to use mock.shop](https://shopify.dev/docs/storefronts/headless/mock-shop).
- `https://mock.shop/llms.txt` lists every store with a one-line summary and its API URL. Each store is a separate catalog on its own host, and `https://<store>.mock.shop/llms.txt` describes that store's catalog.
- Send Storefront API queries as `POST https://<store>.mock.shop/api` with a JSON body (`{"query": "..."}`) and `Content-Type: application/json`. No access token or other credentials are needed; never send credentials to mock.shop. The bare apex `https://mock.shop/api` serves the default store. mock.shop also answers the versioned endpoint shape, `https://<store>.mock.shop/api/<version>/graphql.json`, so clients can use the same URL structure as a real store.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## mock.shop: a store to build against before you have one
[mock.shop](https://mock.shop) is a public, auth-free Storefront GraphQL API backed by mock reference stores. Use mock.shop when the user has no store, no Storefront API access token, or wants realistic data to build against. Find the setup guide at [How to use mock.shop](https://shopify.dev/docs/storefronts/headless/mock-shop).
- `https://mock.shop/llms.txt` lists every store with a one-line summary and its API URL. Each store is a separate catalog on its own host, and `https://<store>.mock.shop/llms.txt` describes that store's catalog.
- Send Storefront API queries as `POST https://<store>.mock.shop/api` with a JSON body (`{"query": "..."}`) and `Content-Type: application/json`. No access token or other credentials are needed; never send credentials to mock.shop. The bare apex `https://mock.shop/api` serves the default store. mock.shop also answers the versioned endpoint shape, `https://<store>.mock.shop/api/<version>/graphql.json`, so clients can use the same URL structure as a real store.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## mock.shop: a store to build against before you have one
[mock.shop](https://mock.shop) is a public, auth-free Storefront GraphQL API backed by mock reference stores. Use mock.shop when the user has no store, no Storefront API access token, or wants realistic data to build against. Find the setup guide at [How to use mock.shop](https://shopify.dev/docs/storefronts/headless/mock-shop).
- `https://mock.shop/llms.txt` lists every store with a one-line summary and its API URL. Each store is a separate catalog on its own host, and `https://<store>.mock.shop/llms.txt` describes that store's catalog.
- Send Storefront API queries as `POST https://<store>.mock.shop/api` with a JSON body (`{"query": "..."}`) and `Content-Type: application/json`. No access token or other credentials are needed; never send credentials to mock.shop. The bare apex `https://mock.shop/api` serves the default store. mock.shop also answers the versioned endpoint shape, `https://<store>.mock.shop/api/<version>/graphql.json`, so clients can use the same URL structure as a real store.
Detected: suspicious.env_credential_access
`)}r(st,"formatCliHelp");function at(){let e=[process.env.CLAUDE_SESSION_ID,process.env.CLAUDE_CODE_SESSION_ID,process.env.CURSOR_SESSION_ID,process.env.COPILOT...`));return e.line+=c.length-1,e.lineStart=o,p}if(l===92&&n.charCodeAt(s+1)===34&&n.charCodeAt(s+2)===34&&n.charCodeAt(s+3)===34){u+=n.slice(a,s),a=s+1,s+=4;cont...`));return e.line+=c.length-1,e.lineStart=o,p}if(l===92&&n.charCodeAt(s+1)===34&&n.charCodeAt(s+2)===34&&n.charCodeAt(s+3)===34){u+=n.slice(a,s),a=s+1,s+=4;cont...`)}o(K,"formatCliHelp");function q(){let e=[process.env.CLAUDE_SESSION_ID,process.env.CLAUDE_CODE_SESSION_ID,process.env.CURSOR_SESSION_ID,process.env.COPILOT_S...var le=Object.defineProperty;var n=(e,t)=>le(e,"name",{value:t,configurable:!0});import{createHash as Le}from"crypto";import{chmodSync as ke,closeSync as xe,lst...`)}o(R,"formatCliHelp");function C(){let e=[process.env.CLAUDE_SESSION_ID,process.env.CLAUDE_CODE_SESSION_ID,process.env.CURSOR_SESSION_ID,process.env.COPILOT_S...var le=Object.defineProperty;var r=(e,t)=>le(e,"name",{value:t,configurable:!0});var l=["use-shopify-cli","admin","shopifyql","storefront-graphql","partner","cu...var le=Object.defineProperty;var n=(e,t)=>le(e,"name",{value:t,configurable:!0});import{createHash as Le}from"crypto";import{chmodSync as ke,closeSync as xe,lst...`)}o(N,"formatCliHelp");function R(){let e=[process.env.CLAUDE_SESSION_ID,process.env.CLAUDE_CODE_SESSION_ID,process.env.CURSOR_SESSION_ID,process.env.COPILOT_S...