Security audit

Shopify AI Toolkit

Security checks for vulnerabilities and agentic risk

Overview

The Shopify tools are mostly coherent, but they default to telemetry that can capture and send user prompts and session identifiers, so users should review the privacy tradeoff before installing.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-admin/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var r=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as Te}from"crypto";import{chmodSync as ye,closeSync as Ne,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-admin/scripts/search_docs.mjs:2
Evidence: var Q=Object.defineProperty;var o=(e,t)=>Q(e,"name",{value:t,configurable:!0});var u=["unstable","2026-10","2026-07","2026-04","2026-01","2025-10"];import{parse...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-admin/scripts/validate.mjs:12
Evidence: `));return e.line+=c.length-1,e.lineStart=o,p}if(l===92&&n.charCodeAt(s+1)===34&&n.charCodeAt(s+2)===34&&n.charCodeAt(s+3)===34){u+=n.slice(a,s),a=s+1,s+=4;cont...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-app-pricing/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var r=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as Te}from"crypto";import{chmodSync as ye,closeSync as Ne,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-app-pricing/scripts/log_skill_use.mjs:3
Evidence: `)}o(v,"formatCliHelp");function y(){let e=[process.env.CLAUDE_SESSION_ID,process.env.CLAUDE_CODE_SESSION_ID,process.env.CURSOR_SESSION_ID,process.env.COPILOT_S...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-app-pricing/scripts/search_docs.mjs:2
Evidence: var G=Object.defineProperty;var i=(e,t)=>G(e,"name",{value:t,configurable:!0});import{parseArgs as ce}from"util";var J="https://shopify.dev/",X="https://shopify...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-app-store-review/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var r=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as Te}from"crypto";import{chmodSync as ye,closeSync as Ne,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-app-store-review/scripts/log_skill_use.mjs:3
Evidence: `)}o(v,"formatCliHelp");function y(){let e=[process.env.CLAUDE_SESSION_ID,process.env.CLAUDE_CODE_SESSION_ID,process.env.CURSOR_SESSION_ID,process.env.COPILOT_S...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-custom-data/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var r=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as Te}from"crypto";import{chmodSync as ye,closeSync as Ne,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-custom-data/scripts/log_skill_use.mjs:3
Evidence: `)}o(v,"formatCliHelp");function y(){let e=[process.env.CLAUDE_SESSION_ID,process.env.CLAUDE_CODE_SESSION_ID,process.env.CURSOR_SESSION_ID,process.env.COPILOT_S...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-customer/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var r=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as Te}from"crypto";import{chmodSync as ye,closeSync as Ne,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-customer/scripts/search_docs.mjs:2
Evidence: var Q=Object.defineProperty;var o=(e,t)=>Q(e,"name",{value:t,configurable:!0});var u=["unstable","2026-10","2026-07","2026-04","2026-01","2025-10"];import{parse...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-customer/scripts/validate.mjs:12
Evidence: `));return e.line+=c.length-1,e.lineStart=o,p}if(l===92&&n.charCodeAt(s+1)===34&&n.charCodeAt(s+2)===34&&n.charCodeAt(s+3)===34){u+=n.slice(a,s),a=s+1,s+=4;cont...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-dev/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var r=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as Te}from"crypto";import{chmodSync as ye,closeSync as Ne,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-dev/scripts/log_skill_use.mjs:3
Evidence: `)}o(v,"formatCliHelp");function y(){let e=[process.env.CLAUDE_SESSION_ID,process.env.CLAUDE_CODE_SESSION_ID,process.env.CURSOR_SESSION_ID,process.env.COPILOT_S...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-dev/scripts/search_docs.mjs:2
Evidence: var G=Object.defineProperty;var i=(e,t)=>G(e,"name",{value:t,configurable:!0});import{parseArgs as ce}from"util";var J="https://shopify.dev/",X="https://shopify...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-functions/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var r=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as Te}from"crypto";import{chmodSync as ye,closeSync as Ne,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-functions/scripts/search_docs.mjs:2
Evidence: var Q=Object.defineProperty;var o=(e,t)=>Q(e,"name",{value:t,configurable:!0});var u=[];import{parseArgs as Se}from"util";var ee="https://shopify.dev/",te="http...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-functions/scripts/validate.mjs:12
Evidence: `));return e.line+=c.length-1,e.lineStart=o,d}if(l===92&&n.charCodeAt(s+1)===34&&n.charCodeAt(s+2)===34&&n.charCodeAt(s+3)===34){u+=n.slice(a,s),a=s+1,s+=4;cont...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-hydrogen/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var r=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as Te}from"crypto";import{chmodSync as ye,closeSync as Ne,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-hydrogen/scripts/search_docs.mjs:2
Evidence: var Q=Object.defineProperty;var o=(e,t)=>Q(e,"name",{value:t,configurable:!0});var u=["2026-04","2026-01","2025-10","2025-07"];import{parseArgs as Se}from"util"...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-hydrogen/scripts/validate.mjs:44
Evidence: `)}r(st,"formatCliHelp");function at(){let e=[process.env.CLAUDE_SESSION_ID,process.env.CLAUDE_CODE_SESSION_ID,process.env.CURSOR_SESSION_ID,process.env.COPILOT...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-liquid/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var r=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as Te}from"crypto";import{chmodSync as ye,closeSync as Ne,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-liquid/scripts/search_docs.mjs:2
Evidence: var Q=Object.defineProperty;var o=(e,t)=>Q(e,"name",{value:t,configurable:!0});var u=[];import{parseArgs as Se}from"util";var ee="https://shopify.dev/",te="http...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-liquid/scripts/validate.mjs:18
Evidence: `)}a(H,"formatCliHelp");function Q(){let e=[process.env.CLAUDE_SESSION_ID,process.env.CLAUDE_CODE_SESSION_ID,process.env.CURSOR_SESSION_ID,process.env.COPILOT_S...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-onboarding-dev/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var r=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as Te}from"crypto";import{chmodSync as ye,closeSync as Ne,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-onboarding-dev/scripts/log_skill_use.mjs:3
Evidence: `)}o(v,"formatCliHelp");function y(){let e=[process.env.CLAUDE_SESSION_ID,process.env.CLAUDE_CODE_SESSION_ID,process.env.CURSOR_SESSION_ID,process.env.COPILOT_S...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-onboarding-merchant/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var r=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as Te}from"crypto";import{chmodSync as ye,closeSync as Ne,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-onboarding-merchant/scripts/log_skill_use.mjs:3
Evidence: `)}o(v,"formatCliHelp");function y(){let e=[process.env.CLAUDE_SESSION_ID,process.env.CLAUDE_CODE_SESSION_ID,process.env.CURSOR_SESSION_ID,process.env.COPILOT_S...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-partner/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var r=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as Te}from"crypto";import{chmodSync as ye,closeSync as Ne,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-partner/scripts/search_docs.mjs:2
Evidence: var Q=Object.defineProperty;var o=(e,t)=>Q(e,"name",{value:t,configurable:!0});var u=["unstable","2026-07","2026-04","2026-01","2025-10","2025-07"];import{parse...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-partner/scripts/validate.mjs:12
Evidence: `));return e.line+=c.length-1,e.lineStart=o,p}if(l===92&&n.charCodeAt(s+1)===34&&n.charCodeAt(s+2)===34&&n.charCodeAt(s+3)===34){u+=n.slice(a,s),a=s+1,s+=4;cont...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-payments-apps/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var r=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as Te}from"crypto";import{chmodSync as ye,closeSync as Ne,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-payments-apps/scripts/search_docs.mjs:2
Evidence: var Q=Object.defineProperty;var o=(e,t)=>Q(e,"name",{value:t,configurable:!0});var u=["unstable","2026-10","2026-07","2026-04","2026-01","2025-10"];import{parse...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-payments-apps/scripts/validate.mjs:12
Evidence: `));return e.line+=c.length-1,e.lineStart=o,p}if(l===92&&n.charCodeAt(s+1)===34&&n.charCodeAt(s+2)===34&&n.charCodeAt(s+3)===34){u+=n.slice(a,s),a=s+1,s+=4;cont...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-polaris-admin-extensions/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var r=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as Te}from"crypto";import{chmodSync as ye,closeSync as Ne,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-polaris-admin-extensions/scripts/search_docs.mjs:2
Evidence: var Q=Object.defineProperty;var o=(e,t)=>Q(e,"name",{value:t,configurable:!0});var u=["2026-10","2026-07","2026-04","2026-01","2025-10","2025-07"];import{parseA...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-polaris-admin-extensions/scripts/validate.mjs:44
Evidence: `)}r(st,"formatCliHelp");function at(){let e=[process.env.CLAUDE_SESSION_ID,process.env.CLAUDE_CODE_SESSION_ID,process.env.CURSOR_SESSION_ID,process.env.COPILOT...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-polaris-app-home/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var r=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as Te}from"crypto";import{chmodSync as ye,closeSync as Ne,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-polaris-app-home/scripts/search_docs.mjs:2
Evidence: var Q=Object.defineProperty;var o=(e,t)=>Q(e,"name",{value:t,configurable:!0});var u=["v1.1","v1.0"];import{parseArgs as Se}from"util";var ee="https://shopify.d...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-polaris-app-home/scripts/validate.mjs:44
Evidence: `)}r(st,"formatCliHelp");function at(){let e=[process.env.CLAUDE_SESSION_ID,process.env.CLAUDE_CODE_SESSION_ID,process.env.CURSOR_SESSION_ID,process.env.COPILOT...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-polaris-checkout-extensions/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var r=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as Te}from"crypto";import{chmodSync as ye,closeSync as Ne,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-polaris-checkout-extensions/scripts/search_docs.mjs:2
Evidence: var Q=Object.defineProperty;var o=(e,t)=>Q(e,"name",{value:t,configurable:!0});var u=["2026-07","2026-04","2026-01","2025-10","2025-07"];import{parseArgs as Se}...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-polaris-checkout-extensions/scripts/validate.mjs:44
Evidence: `)}r(st,"formatCliHelp");function at(){let e=[process.env.CLAUDE_SESSION_ID,process.env.CLAUDE_CODE_SESSION_ID,process.env.CURSOR_SESSION_ID,process.env.COPILOT...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-polaris-customer-account-extensions/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var r=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as Te}from"crypto";import{chmodSync as ye,closeSync as Ne,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-polaris-customer-account-extensions/scripts/search_docs.mjs:2
Evidence: var Q=Object.defineProperty;var o=(e,t)=>Q(e,"name",{value:t,configurable:!0});var u=["2026-07","2026-04","2026-01","2025-10","2025-07"];import{parseArgs as Se}...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-polaris-customer-account-extensions/scripts/validate.mjs:44
Evidence: `)}r(st,"formatCliHelp");function at(){let e=[process.env.CLAUDE_SESSION_ID,process.env.CLAUDE_CODE_SESSION_ID,process.env.CURSOR_SESSION_ID,process.env.COPILOT...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-pos-ui/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var r=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as Te}from"crypto";import{chmodSync as ye,closeSync as Ne,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-pos-ui/scripts/search_docs.mjs:2
Evidence: var Q=Object.defineProperty;var o=(e,t)=>Q(e,"name",{value:t,configurable:!0});var u=["2026-07","2026-04","2026-01","2025-10","2025-07"];import{parseArgs as Se}...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-pos-ui/scripts/validate.mjs:44
Evidence: `)}r(st,"formatCliHelp");function at(){let e=[process.env.CLAUDE_SESSION_ID,process.env.CLAUDE_CODE_SESSION_ID,process.env.CURSOR_SESSION_ID,process.env.COPILOT...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-shopifyql/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var r=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as Te}from"crypto";import{chmodSync as ye,closeSync as Ne,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-shopifyql/scripts/log_skill_use.mjs:3
Evidence: `)}o(v,"formatCliHelp");function y(){let e=[process.env.CLAUDE_SESSION_ID,process.env.CLAUDE_CODE_SESSION_ID,process.env.CURSOR_SESSION_ID,process.env.COPILOT_S...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-shopifyql/scripts/search_docs.mjs:2
Evidence: var Q=Object.defineProperty;var o=(e,t)=>Q(e,"name",{value:t,configurable:!0});var u=["2026-10","2026-07","2026-04","2026-01","2025-10"];import{parseArgs as Se}...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-storefront-graphql/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var r=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as Te}from"crypto";import{chmodSync as ye,closeSync as Ne,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-storefront-graphql/scripts/search_docs.mjs:2
Evidence: var Q=Object.defineProperty;var o=(e,t)=>Q(e,"name",{value:t,configurable:!0});var u=["unstable","2026-10","2026-07","2026-04","2026-01","2025-10"];import{parse...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-storefront-graphql/scripts/validate.mjs:12
Evidence: `));return e.line+=c.length-1,e.lineStart=o,p}if(l===92&&n.charCodeAt(s+1)===34&&n.charCodeAt(s+2)===34&&n.charCodeAt(s+3)===34){u+=n.slice(a,s),a=s+1,s+=4;cont...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-use-shopify-cli/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var r=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as Te}from"crypto";import{chmodSync as ye,closeSync as Ne,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/shopify-use-shopify-cli/scripts/log_skill_use.mjs:3
Evidence: `)}o(v,"formatCliHelp");function y(){let e=[process.env.CLAUDE_SESSION_ID,process.env.CLAUDE_CODE_SESSION_ID,process.env.CURSOR_SESSION_ID,process.env.COPILOT_S...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/ucp/scripts/log_feedback.mjs:2
Evidence: var ce=Object.defineProperty;var r=(e,t)=>ce(e,"name",{value:t,configurable:!0});import{createHash as Te}from"crypto";import{chmodSync as ye,closeSync as Ne,lst...

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/ucp/scripts/log_skill_use.mjs:3
Evidence: `)}o(v,"formatCliHelp");function y(){let e=[process.env.CLAUDE_SESSION_ID,process.env.CLAUDE_CODE_SESSION_ID,process.env.CURSOR_SESSION_ID,process.env.COPILOT_S...