Shopify助手-免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:31 AM UTC
• Version: 1.0.1

Overview

This Shopify helper is purpose-aligned but needs review because it can execute commands, write files, authenticate to a store, and push theme changes without clear safeguards.

Review this skill before installing. Use it only in a Shopify project, prefer a draft or development theme, confirm the target store and theme before any push, avoid pasting tokens or secrets into the agent, and install Shopify CLI locally with pinned versions where possible instead of using global unpinned npm installs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:172

Finding

Unpinned Global npm Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:172, SKILL.md:248, and SKILL.md:370
Vulnerability Type: Unpinned third-party dependencies installed globally
Risk Level: Medium

Affected code snippets:

SKILL.md:172

bash

npm install -g @shopify/cli @shopify/theme

SKILL.md:248

bash

npm install -g @shopify/cli @shopify/theme

SKILL.md:370

markdown

| Shopify CLI | CLI工具 | 必需 | npm install -g @shopify/cli |

Technical Analysis

The Skill directs the Agent or user to install @shopify/cli and @shopify/theme from npm without specifying exact, reviewed versions or integrity values. Consequently, npm resolves whichever versions are current under the configured registry at installation time. The effective installed code can therefore change after the Skill has been audited.

npm packages and their transitive dependencies may execute lifecycle scripts during installation. If a referenced package, a transitive dependency, a maintainer account, or the configured package registry is compromised, installation could execute attacker-controlled code. The use of the global -g option increases exposure because the packages are installed into the user's global tool environment rather than being isolated to a single project.

No evidence establishes that the named packages are currently malicious. The vulnerability is the mutable and globally scoped dependency-installation practice.

Attack Path

1. An attacker compromises a referenced npm package, one of its transitive dependencies, a package maintainer account, or a registry used by the environment.
2. The attacker publishes a malicious package version or modifies a dependency version selected by npm.
3. An Agent or user follows the Skill's environment-preparation instructions and runs the unpinned global installation command.
4. npm resolves and downloads the attacker-controlled release.
5. Malicious package content ...[truncated 935 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin each dependency to an exact, reviewed version rather than allowing npm to select the latest release:

   bash

   npm install --save-dev --save-exact @shopify/cli@<reviewed-version> @shopify/theme@<reviewed-version>
   

2. Prefer project-local development dependencies over global installation. Invoke the pinned binary through npx --no-install or an npm script so execution cannot silently download another version.
3. Commit and verify a lockfile, and use npm ci for deterministic installation.
4. Configure npm to use the expected official registry and inspect environment-level .npmrc files for unauthorized registry overrides.
5. Review dependency provenance, package ownership, release history, and transitive dependencies before approving upgrades.
6. Use npm integrity verification and trusted CI controls. Where package functionality permits, disable lifecycle scripts with --ignore-scripts; otherwise, explicitly review required lifecycle scripts.
7. Run installation and Shopify tooling as a non-privileged user in an isolated development environment. Do not use sudo or an administrator shell.
8. Update all three documented installation examples so they consistently use the same pinned and locally scoped installation process.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is framed as a general Shopify helper but declares the exec tool, enabling shell command execution in a context that also encourages Shopify CLI login, pull, dev, and push workflows. This expands the skill from passive guidance into an agent capable of making real system and store changes, increasing the risk of unintended command execution, credential exposure, or modification of live assets.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill says tools will automatically execute operations and includes shopify theme push, which can modify live storefront assets, but it does not warn users about production impact or require confirmation. In a commerce context, accidental pushes can break themes, alter customer-facing pages, or disrupt sales.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The authentication workflow instructs users to log in and obtain store access tokens but provides no privacy or secret-handling guidance. In an agent setting with execution and logging, this creates a risk that credentials, tokens, or store identifiers may be echoed, stored, or exposed in prompts, logs, or command history.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger condition covers generic development activities such as code generation, programming assistance, debugging, testing, and deployment, which can cause the skill to activate outside its narrowly described Shopify use case. In combination with read/write/exec capabilities, overly broad routing raises the chance of the agent performing actions on unrelated projects or executing commands without sufficiently specific user intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest display name and summary, along with the rest of the skill instructions, are written in Chinese, but the document does not indicate that the skill is region-specific or provide a user language option. This can conflict with language/locale policy expectations when a skill implicitly forces a language without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.