Trust Assessment
shopify-admin-api received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Skill requires broad Shopify Admin API permissions.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Skill requires broad Shopify Admin API permissions The skill explicitly states it requires 'Full read/write access to Shopify Admin REST API' and lists broad API scopes (e.g., `read_orders`/`write_orders`, `read_products`/`write_products`, `read_customers`/`write_customers`). This grants extensive control over the Shopify store. If the LLM or the skill's invocation is compromised, an attacker could perform highly destructive actions such as deleting products, modifying orders, or exfiltrating sensitive customer data. Review if 'Full read/write access' is strictly necessary for the intended use cases. Implement the principle of least privilege by requesting only the minimum required API scopes (e.g., read-only access, or specific write permissions for only certain resources). If broad access is unavoidable, ensure robust access controls and monitoring are in place for the LLM and its environment, and consider using a dedicated API token with restricted permissions for specific tasks. | LLM | skill.md:7 | |
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/zachgodsell93/shopify-admin-api/skill.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/5f747ea44e53a4ae)
Powered by SkillShield