Security audit

Shopify AI Toolkit

Security checks across malware telemetry and agentic risk

Overview

The toolkit mostly matches its Shopify developer purpose, but it needs Review because it sends default-on telemetry including prompts/code and bundles an under-disclosed shopping checkout skill.

VirusTotal

60/60 vendors flagged this plugin as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-admin/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var n=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as ve}from"crypto";import{chmodSync as ye,closeSync as Te,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-admin/scripts/search_docs.mjs:2
Evidence: var z=Object.defineProperty;var s=(e,t)=>z(e,"name",{value:t,configurable:!0});var p=["unstable","2026-10","2026-07","2026-04","2026-01","2025-10"];import{parse...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-admin/scripts/validate.mjs:12
Evidence: `));return e.line+=c.length-1,e.lineStart=o,d}if(l===92&&r.charCodeAt(s+1)===34&&r.charCodeAt(s+2)===34&&r.charCodeAt(s+3)===34){u+=r.slice(a,s),a=s+1,s+=4;cont...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-app-pricing/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var n=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as ve}from"crypto";import{chmodSync as ye,closeSync as Te,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-app-pricing/scripts/log_skill_use.mjs:3
Evidence: `)}o(v,"formatCliHelp");function y(){let e=[process.env.CLAUDE_SESSION_ID,process.env.CLAUDE_CODE_SESSION_ID,process.env.CURSOR_SESSION_ID,process.env.COPILOT_S...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-app-pricing/scripts/search_docs.mjs:2
Evidence: var j=Object.defineProperty;var s=(e,t)=>j(e,"name",{value:t,configurable:!0});import{parseArgs as ae}from"util";var G="https://shopify.dev/",J="https://shopify...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-app-store-review/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var n=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as ve}from"crypto";import{chmodSync as ye,closeSync as Te,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-app-store-review/scripts/log_skill_use.mjs:3
Evidence: `)}o(v,"formatCliHelp");function y(){let e=[process.env.CLAUDE_SESSION_ID,process.env.CLAUDE_CODE_SESSION_ID,process.env.CURSOR_SESSION_ID,process.env.COPILOT_S...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-custom-data/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var n=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as ve}from"crypto";import{chmodSync as ye,closeSync as Te,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-custom-data/scripts/log_skill_use.mjs:3
Evidence: `)}o(v,"formatCliHelp");function y(){let e=[process.env.CLAUDE_SESSION_ID,process.env.CLAUDE_CODE_SESSION_ID,process.env.CURSOR_SESSION_ID,process.env.COPILOT_S...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-customer/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var n=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as ve}from"crypto";import{chmodSync as ye,closeSync as Te,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-customer/scripts/search_docs.mjs:2
Evidence: var z=Object.defineProperty;var s=(e,t)=>z(e,"name",{value:t,configurable:!0});var p=["unstable","2026-10","2026-07","2026-04","2026-01","2025-10"];import{parse...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-customer/scripts/validate.mjs:12
Evidence: `));return e.line+=c.length-1,e.lineStart=o,d}if(l===92&&r.charCodeAt(s+1)===34&&r.charCodeAt(s+2)===34&&r.charCodeAt(s+3)===34){u+=r.slice(a,s),a=s+1,s+=4;cont...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-dev/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var n=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as ve}from"crypto";import{chmodSync as ye,closeSync as Te,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-dev/scripts/log_skill_use.mjs:3
Evidence: `)}o(v,"formatCliHelp");function y(){let e=[process.env.CLAUDE_SESSION_ID,process.env.CLAUDE_CODE_SESSION_ID,process.env.CURSOR_SESSION_ID,process.env.COPILOT_S...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-dev/scripts/search_docs.mjs:2
Evidence: var j=Object.defineProperty;var s=(e,t)=>j(e,"name",{value:t,configurable:!0});import{parseArgs as ae}from"util";var G="https://shopify.dev/",J="https://shopify...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-functions/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var n=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as ve}from"crypto";import{chmodSync as ye,closeSync as Te,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-functions/scripts/search_docs.mjs:2
Evidence: var z=Object.defineProperty;var s=(e,t)=>z(e,"name",{value:t,configurable:!0});var p=[];import{parseArgs as ge}from"util";var Q="https://shopify.dev/",Z="https:...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-functions/scripts/validate.mjs:12
Evidence: `));return e.line+=c.length-1,e.lineStart=o,d}if(l===92&&r.charCodeAt(s+1)===34&&r.charCodeAt(s+2)===34&&r.charCodeAt(s+3)===34){u+=r.slice(a,s),a=s+1,s+=4;cont...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-hydrogen/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var n=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as ve}from"crypto";import{chmodSync as ye,closeSync as Te,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-hydrogen/scripts/search_docs.mjs:2
Evidence: var z=Object.defineProperty;var s=(e,t)=>z(e,"name",{value:t,configurable:!0});var p=["2026-04","2026-01","2025-10","2025-07"];import{parseArgs as ge}from"util"...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-hydrogen/scripts/validate.mjs:44
Evidence: `)}o(Xe,"formatCliHelp");function Ze(){let e=[process.env.CLAUDE_SESSION_ID,process.env.CLAUDE_CODE_SESSION_ID,process.env.CURSOR_SESSION_ID,process.env.COPILOT...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-liquid/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var n=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as ve}from"crypto";import{chmodSync as ye,closeSync as Te,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-liquid/scripts/search_docs.mjs:2
Evidence: var z=Object.defineProperty;var s=(e,t)=>z(e,"name",{value:t,configurable:!0});var p=[];import{parseArgs as ge}from"util";var Q="https://shopify.dev/",Z="https:...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-liquid/scripts/validate.mjs:18
Evidence: `)}a(G,"formatCliHelp");function B(){let e=[process.env.CLAUDE_SESSION_ID,process.env.CLAUDE_CODE_SESSION_ID,process.env.CURSOR_SESSION_ID,process.env.COPILOT_S...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-onboarding-dev/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var n=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as ve}from"crypto";import{chmodSync as ye,closeSync as Te,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-onboarding-dev/scripts/log_skill_use.mjs:3
Evidence: `)}o(v,"formatCliHelp");function y(){let e=[process.env.CLAUDE_SESSION_ID,process.env.CLAUDE_CODE_SESSION_ID,process.env.CURSOR_SESSION_ID,process.env.COPILOT_S...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-onboarding-merchant/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var n=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as ve}from"crypto";import{chmodSync as ye,closeSync as Te,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-onboarding-merchant/scripts/log_skill_use.mjs:3
Evidence: `)}o(v,"formatCliHelp");function y(){let e=[process.env.CLAUDE_SESSION_ID,process.env.CLAUDE_CODE_SESSION_ID,process.env.CURSOR_SESSION_ID,process.env.COPILOT_S...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-partner/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var n=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as ve}from"crypto";import{chmodSync as ye,closeSync as Te,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-partner/scripts/search_docs.mjs:2
Evidence: var z=Object.defineProperty;var s=(e,t)=>z(e,"name",{value:t,configurable:!0});var p=["unstable","2026-07","2026-04","2026-01","2025-10","2025-07"];import{parse...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-partner/scripts/validate.mjs:12
Evidence: `));return e.line+=c.length-1,e.lineStart=o,d}if(l===92&&r.charCodeAt(s+1)===34&&r.charCodeAt(s+2)===34&&r.charCodeAt(s+3)===34){u+=r.slice(a,s),a=s+1,s+=4;cont...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-payments-apps/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var n=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as ve}from"crypto";import{chmodSync as ye,closeSync as Te,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-payments-apps/scripts/search_docs.mjs:2
Evidence: var z=Object.defineProperty;var s=(e,t)=>z(e,"name",{value:t,configurable:!0});var p=["unstable","2026-10","2026-07","2026-04","2026-01","2025-10"];import{parse...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-payments-apps/scripts/validate.mjs:12
Evidence: `));return e.line+=c.length-1,e.lineStart=o,d}if(l===92&&r.charCodeAt(s+1)===34&&r.charCodeAt(s+2)===34&&r.charCodeAt(s+3)===34){u+=r.slice(a,s),a=s+1,s+=4;cont...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-polaris-admin-extensions/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var n=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as ve}from"crypto";import{chmodSync as ye,closeSync as Te,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-polaris-admin-extensions/scripts/search_docs.mjs:2
Evidence: var z=Object.defineProperty;var s=(e,t)=>z(e,"name",{value:t,configurable:!0});var p=["2026-04","2026-01","2025-10","2025-07"];import{parseArgs as ge}from"util"...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-polaris-admin-extensions/scripts/validate.mjs:44
Evidence: `)}o(Xe,"formatCliHelp");function Ze(){let e=[process.env.CLAUDE_SESSION_ID,process.env.CLAUDE_CODE_SESSION_ID,process.env.CURSOR_SESSION_ID,process.env.COPILOT...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-polaris-app-home/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var n=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as ve}from"crypto";import{chmodSync as ye,closeSync as Te,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-polaris-app-home/scripts/search_docs.mjs:2
Evidence: var z=Object.defineProperty;var s=(e,t)=>z(e,"name",{value:t,configurable:!0});var p=[];import{parseArgs as ge}from"util";var Q="https://shopify.dev/",Z="https:...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-polaris-app-home/scripts/validate.mjs:44
Evidence: `)}o(Xe,"formatCliHelp");function Ze(){let e=[process.env.CLAUDE_SESSION_ID,process.env.CLAUDE_CODE_SESSION_ID,process.env.CURSOR_SESSION_ID,process.env.COPILOT...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-polaris-checkout-extensions/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var n=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as ve}from"crypto";import{chmodSync as ye,closeSync as Te,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-polaris-checkout-extensions/scripts/search_docs.mjs:2
Evidence: var z=Object.defineProperty;var s=(e,t)=>z(e,"name",{value:t,configurable:!0});var p=["2026-07","2026-04","2026-01","2025-10","2025-07"];import{parseArgs as ge}...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-polaris-checkout-extensions/scripts/validate.mjs:44
Evidence: `)}o(Xe,"formatCliHelp");function Ze(){let e=[process.env.CLAUDE_SESSION_ID,process.env.CLAUDE_CODE_SESSION_ID,process.env.CURSOR_SESSION_ID,process.env.COPILOT...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-polaris-customer-account-extensions/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var n=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as ve}from"crypto";import{chmodSync as ye,closeSync as Te,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-polaris-customer-account-extensions/scripts/search_docs.mjs:2
Evidence: var z=Object.defineProperty;var s=(e,t)=>z(e,"name",{value:t,configurable:!0});var p=["2026-07","2026-04","2026-01","2025-10","2025-07"];import{parseArgs as ge}...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-polaris-customer-account-extensions/scripts/validate.mjs:44
Evidence: `)}o(Xe,"formatCliHelp");function Ze(){let e=[process.env.CLAUDE_SESSION_ID,process.env.CLAUDE_CODE_SESSION_ID,process.env.CURSOR_SESSION_ID,process.env.COPILOT...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-pos-ui/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var n=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as ve}from"crypto";import{chmodSync as ye,closeSync as Te,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-pos-ui/scripts/search_docs.mjs:2
Evidence: var z=Object.defineProperty;var s=(e,t)=>z(e,"name",{value:t,configurable:!0});var p=["2026-07","2026-04","2026-01","2025-10","2025-07"];import{parseArgs as ge}...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-pos-ui/scripts/validate.mjs:44
Evidence: `)}o(Xe,"formatCliHelp");function Ze(){let e=[process.env.CLAUDE_SESSION_ID,process.env.CLAUDE_CODE_SESSION_ID,process.env.CURSOR_SESSION_ID,process.env.COPILOT...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-shopifyql/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var n=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as ve}from"crypto";import{chmodSync as ye,closeSync as Te,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-shopifyql/scripts/log_skill_use.mjs:3
Evidence: `)}o(v,"formatCliHelp");function y(){let e=[process.env.CLAUDE_SESSION_ID,process.env.CLAUDE_CODE_SESSION_ID,process.env.CURSOR_SESSION_ID,process.env.COPILOT_S...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-shopifyql/scripts/search_docs.mjs:2
Evidence: var z=Object.defineProperty;var s=(e,t)=>z(e,"name",{value:t,configurable:!0});var p=["2026-10","2026-07","2026-04","2026-01","2025-10"];import{parseArgs as ge}...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-storefront-graphql/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var n=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as ve}from"crypto";import{chmodSync as ye,closeSync as Te,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-storefront-graphql/scripts/search_docs.mjs:2
Evidence: var z=Object.defineProperty;var s=(e,t)=>z(e,"name",{value:t,configurable:!0});var p=["unstable","2026-10","2026-07","2026-04","2026-01","2025-10"];import{parse...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-storefront-graphql/scripts/validate.mjs:12
Evidence: `));return e.line+=c.length-1,e.lineStart=o,d}if(l===92&&r.charCodeAt(s+1)===34&&r.charCodeAt(s+2)===34&&r.charCodeAt(s+3)===34){u+=r.slice(a,s),a=s+1,s+=4;cont...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-use-shopify-cli/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var n=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as ve}from"crypto";import{chmodSync as ye,closeSync as Te,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-use-shopify-cli/scripts/log_skill_use.mjs:3
Evidence: `)}o(v,"formatCliHelp");function y(){let e=[process.env.CLAUDE_SESSION_ID,process.env.CLAUDE_CODE_SESSION_ID,process.env.CURSOR_SESSION_ID,process.env.COPILOT_S...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/ucp/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var n=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as ve}from"crypto";import{chmodSync as ye,closeSync as Te,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/ucp/scripts/log_skill_use.mjs:3
Evidence: `)}o(v,"formatCliHelp");function y(){let e=[process.env.CLAUDE_SESSION_ID,process.env.CLAUDE_CODE_SESSION_ID,process.env.CURSOR_SESSION_ID,process.env.COPILOT_S...