Trust Assessment
shopify received a trust score of 90/100, placing it in the Trusted category. This skill has passed all critical security checks and demonstrates strong security practices.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Potential Command Injection via unsanitized user input in `curl` parameters.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential Command Injection via unsanitized user input in `curl` parameters The skill documentation provides `curl` examples that include placeholders or values likely to be derived from user input (e.g., `{order_id}` in the 'Get Order Details' example, product details in 'Create Product', and inventory details in 'Update Inventory'). If the skill's implementation directly interpolates user-provided input into these parameters within a shell command without proper sanitization or escaping, it could lead to command injection. An attacker could inject shell metacharacters (e.g., `;`, `&&`, `|`, backticks) or manipulate JSON payloads to execute arbitrary commands on the host system. When constructing shell commands, ensure all user-provided inputs are properly sanitized, escaped, and quoted. Prefer using API client libraries or `subprocess.run` with `shell=False` and passing arguments as a list, rather than constructing shell strings directly. For `curl` commands, ensure URL paths are URL-encoded, and JSON payloads are properly serialized and quoted to prevent shell metacharacter injection. | LLM | SKILL.md:28 |
Scan History
Embed Code
[](https://skillshield.io/report/e7afce1b20ba6897)
Powered by SkillShield