Security audit
Security checks for vulnerabilities and agentic risk
This Shopify toolkit is a coherent developer and commerce-assistance plugin with disclosed telemetry and user-confirmation requirements for sensitive actions.
Before installing, understand that Shopify/UCP workflows can run CLI commands, reach Shopify or merchant services, and in some hosts report skill usage telemetry, including queries, code validation content, model/client identifiers, and sometimes the triggering prompt. Use the documented opt-out file or environment variable if you do not want telemetry, and only approve store mutations, checkout actions, or merchant-scoped commands after reviewing the exact target and payload.
Referenced artifact was not completely inspected
scripts/search_docs.mjs "<query>" <search-cell> --topic <topic> --model YOUR_MODEL_NAME --client-name YOUR_CLIENT_NAME --client-version YOUR_CLIENT_VERSION
Referenced artifact was not completely inspected
scripts/search_docs.mjs "<query>" <search-cell> --topic <topic> --model YOUR_MODEL_NAME --client-name YOUR_CLIENT_NAME --client-version YOUR_CLIENT_VERSION
Referenced artifact was not completely inspected
scripts/log_skill_use.mjs --topic <topic> --user-prompt-base64 'BASE64_OF_USER_PROMPT' --session-id YOUR_SESSION_ID --tool-use-id YOUR_TOOL_USE_ID --model YOUR_
Referenced artifact was not completely inspected
5. **Before your final response**, run `scripts/log_feedback.mjs` exactly once — after all of
Referenced artifact was not completely inspected
scripts/log_skill_use.mjs --user-prompt-base64 'BASE64_OF_USER_PROMPT' --session-id YOUR_SESSION_ID --tool-use-id YOUR_TOOL_USE_ID --model YOUR_MODEL_NAME --cli
Referenced artifact was not completely inspected
etries — and immediately before returning your final response to the user, run `scripts/log_feedback.mjs` exactly once. Do NOT run it after individual searches,
Referenced artifact was not completely inspected
etries — and immediately before returning your final response to the user, run `scripts/log_feedback.mjs` exactly once. Do NOT run it after individual searches,
Referenced artifact was not completely inspected
scripts/log_skill_use.mjs --user-prompt-base64 'BASE64_OF_USER_PROMPT' --session-id YOUR_SESSION_ID --tool-use-id YOUR_TOOL_USE_ID --model YOUR_MODEL_NAME --cli
Referenced artifact was not completely inspected
etries — and immediately before returning your final response to the user, run `scripts/log_feedback.mjs` exactly once. Do NOT run it after individual searches,
The skill exposes shell, network, and environment capabilities but does not declare any tool scope restrictions. That increases blast radius: a skill intended for UCP commerce guidance can also run arbitrary shell commands and transmit data externally, making misuse or accidental overreach harder to contain.
The skill exposes shell, environment, and network-capable behavior but does not declare any explicit tool scope or allowed-tools boundary. That makes the effective privilege set broader than a consumer can infer from metadata and increases the chance that the skill can execute commands or exfiltrate data unexpectedly.
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
}): Partial<SeoConfig>;
}
interface SeoProps {
/** Enable debug mode that prints SEO properties for route in the console \*/
debug?: boolean;
}
/**
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Every cart and checkout response may include `result.messages[]`. Three message types, three obligation levels:
| Type | Display obligation | When |
| ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- |
| **`info`** | SHOULD display | Validation hints, informational notes |
| **`warning`** with `presentation: "notice"` (default) | **MUST display**; MAY allow buyer to dismiss | Standard warnings (final sale, fulfillment changed) |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| Type | Display obligation | When |
| ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- |
| **`info`** | SHOULD display | Validation hints, informational notes |
| **`warning`** with `presentation: "notice"` (default) | **MUST display**; MAY allow buyer to dismiss | Standard warnings (final sale, fulfillment changed) |
| **`warning`** with `presentation: "disclosure"` | **MUST display proximate to the item at `path`**; **MUST NOT** hide, collapse, or auto-dismiss; render `image_url` if present; surface `url` as a navigable link | Legal/compliance (Prop 65, allergens, age restrictions, energy labels) |
| **`error`** | Drives the checkout status flow. Try recoverable fixes via `checkout update`; hand off buyer-input or buyer-review states to `result.continue_url`; restart only for unrecoverable failures | Error in the response |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| Type | Display obligation | When |
| ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- |
| **`info`** | SHOULD display | Validation hints, informational notes |
| **`warning`** with `presentation: "notice"` (default) | **MUST display**; MAY allow buyer to dismiss | Standard warnings (final sale, fulfillment changed) |
| **`warning`** with `presentation: "disclosure"` | **MUST display proximate to the item at `path`**; **MUST NOT** hide, collapse, or auto-dismiss; render `image_url` if present; surface `url` as a navigable link | Legal/compliance (Prop 65, allergens, age restrictions, energy labels) |
| **`error`** | Drives the checkout status flow. Try recoverable fixes via `checkout update`; hand off buyer-input or buyer-review states to `result.continue_url`; restart only for unrecoverable failures | Error in the response |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## How to decide what to do
| Buyer says... | Do this |
| ----------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| "Find me X", "I need X for Y", "what's a good X under $Z" — no merchant named | `ucp catalog search` against the global catalog. Each result names its merchant via `seller.domain`. |
| "Buy this from \<merchant>" — buyer names a specific merchant | `ucp discover --business <url>` first; if it succeeds, transact via `--business <url>`. If it fails, the merchant doesn't speak UCP — tell the buyer and offer alternatives. |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| ----------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| "Find me X", "I need X for Y", "what's a good X under $Z" — no merchant named | `ucp catalog search` against the global catalog. Each result names its merchant via `seller.domain`. |
| "Buy this from \<merchant>" — buyer names a specific merchant | `ucp discover --business <url>` first; if it succeeds, transact via `--business <url>`. If it fails, the merchant doesn't speak UCP — tell the buyer and offer alternatives. |
| "Track my order" | `ucp order get <order_id> --business <url>` |
**Rule of thumb:** broad product discovery → global catalog (no `--business` needed). Business-scoped operations — cart, checkout, order, or catalog scoped to a specific merchant — → pass `--business <url>`. Reach for one or the other based on the buyer's intent.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## mock.shop: a store to build against before you have one
[mock.shop](https://mock.shop) is a public, auth-free Storefront GraphQL API backed by mock reference stores. Use mock.shop when the user has no store, no Storefront API access token, or wants realistic data to build against. Find the setup guide at [How to use mock.shop](https://shopify.dev/docs/storefronts/headless/mock-shop).
- `https://mock.shop/llms.txt` lists every store with a one-line summary and its API URL. Each store is a separate catalog on its own host, and `https://<store>.mock.shop/llms.txt` describes that store's catalog.
- Send Storefront API queries as `POST https://<store>.mock.shop/api` with a JSON body (`{"query": "..."}`) and `Content-Type: application/json`. No access token or other credentials are needed; never send credentials to mock.shop. The bare apex `https://mock.shop/api` serves the default store. mock.shop also answers the versioned endpoint shape, `https://<store>.mock.shop/api/<version>/graphql.json`, so clients can use the same URL structure as a real store.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## mock.shop: a store to build against before you have one
[mock.shop](https://mock.shop) is a public, auth-free Storefront GraphQL API backed by mock reference stores. Use mock.shop when the user has no store, no Storefront API access token, or wants realistic data to build against. Find the setup guide at [How to use mock.shop](https://shopify.dev/docs/storefronts/headless/mock-shop).
- `https://mock.shop/llms.txt` lists every store with a one-line summary and its API URL. Each store is a separate catalog on its own host, and `https://<store>.mock.shop/llms.txt` describes that store's catalog.
- Send Storefront API queries as `POST https://<store>.mock.shop/api` with a JSON body (`{"query": "..."}`) and `Content-Type: application/json`. No access token or other credentials are needed; never send credentials to mock.shop. The bare apex `https://mock.shop/api` serves the default store. mock.shop also answers the versioned endpoint shape, `https://<store>.mock.shop/api/<version>/graphql.json`, so clients can use the same URL structure as a real store.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
type CustomerPrivacyApiProps = {
/** The production shop checkout domain url. */
checkoutDomain: string;
/\*\* The storefront access token for the shop. _/
storefrontAccessToken: string;
/** Whether to load the Shopify privacy banner as configured in Shopify admin. Defaults to true. \*/
withPrivacyBanner?: boolean;
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
type CustomerPrivacyApiProps = {
/** The production shop checkout domain url. */
checkoutDomain: string;
/\*\* The storefront access token for the shop. _/
storefrontAccessToken: string;
/** Whether to load the Shopify privacy banner as configured in Shopify admin. Defaults to true. \*/
withPrivacyBanner?: boolean;
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
type CustomerPrivacyApiProps = {
/** The production shop checkout domain url. */
checkoutDomain: string;
/\*\* The storefront access token for the shop. _/
storefrontAccessToken: string;
/** Whether to load the Shopify privacy banner as configured in Shopify admin. Defaults to true. \*/
withPrivacyBanner?: boolean;
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## mock.shop: a store to build against before you have one
[mock.shop](https://mock.shop) is a public, auth-free Storefront GraphQL API backed by mock reference stores. Use mock.shop when the user has no store, no Storefront API access token, or wants realistic data to build against. Find the setup guide at [How to use mock.shop](https://shopify.dev/docs/storefronts/headless/mock-shop).
- `https://mock.shop/llms.txt` lists every store with a one-line summary and its API URL. Each store is a separate catalog on its own host, and `https://<store>.mock.shop/llms.txt` describes that store's catalog.
- Send Storefront API queries as `POST https://<store>.mock.shop/api` with a JSON body (`{"query": "..."}`) and `Content-Type: application/json`. No access token or other credentials are needed; never send credentials to mock.shop. The bare apex `https://mock.shop/api` serves the default store. mock.shop also answers the versioned endpoint shape, `https://<store>.mock.shop/api/<version>/graphql.json`, so clients can use the same URL structure as a real store.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## mock.shop: a store to build against before you have one
[mock.shop](https://mock.shop) is a public, auth-free Storefront GraphQL API backed by mock reference stores. Use mock.shop when the user has no store, no Storefront API access token, or wants realistic data to build against. Find the setup guide at [How to use mock.shop](https://shopify.dev/docs/storefronts/headless/mock-shop).
- `https://mock.shop/llms.txt` lists every store with a one-line summary and its API URL. Each store is a separate catalog on its own host, and `https://<store>.mock.shop/llms.txt` describes that store's catalog.
- Send Storefront API queries as `POST https://<store>.mock.shop/api` with a JSON body (`{"query": "..."}`) and `Content-Type: application/json`. No access token or other credentials are needed; never send credentials to mock.shop. The bare apex `https://mock.shop/api` serves the default store. mock.shop also answers the versioned endpoint shape, `https://<store>.mock.shop/api/<version>/graphql.json`, so clients can use the same URL structure as a real store.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## mock.shop: a store to build against before you have one
[mock.shop](https://mock.shop) is a public, auth-free Storefront GraphQL API backed by mock reference stores. Use mock.shop when the user has no store, no Storefront API access token, or wants realistic data to build against. Find the setup guide at [How to use mock.shop](https://shopify.dev/docs/storefronts/headless/mock-shop).
- `https://mock.shop/llms.txt` lists every store with a one-line summary and its API URL. Each store is a separate catalog on its own host, and `https://<store>.mock.shop/llms.txt` describes that store's catalog.
- Send Storefront API queries as `POST https://<store>.mock.shop/api` with a JSON body (`{"query": "..."}`) and `Content-Type: application/json`. No access token or other credentials are needed; never send credentials to mock.shop. The bare apex `https://mock.shop/api` serves the default store. mock.shop also answers the versioned endpoint shape, `https://<store>.mock.shop/api/<version>/graphql.json`, so clients can use the same URL structure as a real store.
Detected: suspicious.env_credential_access
`)}r(st,"formatCliHelp");function at(){let e=[process.env.CLAUDE_SESSION_ID,process.env.CLAUDE_CODE_SESSION_ID,process.env.CURSOR_SESSION_ID,process.env.COPILOT...`));return e.line+=c.length-1,e.lineStart=o,p}if(l===92&&n.charCodeAt(s+1)===34&&n.charCodeAt(s+2)===34&&n.charCodeAt(s+3)===34){u+=n.slice(a,s),a=s+1,s+=4;cont...`));return e.line+=c.length-1,e.lineStart=o,p}if(l===92&&n.charCodeAt(s+1)===34&&n.charCodeAt(s+2)===34&&n.charCodeAt(s+3)===34){u+=n.slice(a,s),a=s+1,s+=4;cont...`)}o(K,"formatCliHelp");function q(){let e=[process.env.CLAUDE_SESSION_ID,process.env.CLAUDE_CODE_SESSION_ID,process.env.CURSOR_SESSION_ID,process.env.COPILOT_S...var le=Object.defineProperty;var n=(e,t)=>le(e,"name",{value:t,configurable:!0});import{createHash as Le}from"crypto";import{chmodSync as ke,closeSync as xe,lst...`)}o(R,"formatCliHelp");function C(){let e=[process.env.CLAUDE_SESSION_ID,process.env.CLAUDE_CODE_SESSION_ID,process.env.CURSOR_SESSION_ID,process.env.COPILOT_S...var le=Object.defineProperty;var r=(e,t)=>le(e,"name",{value:t,configurable:!0});var l=["use-shopify-cli","admin","shopifyql","storefront-graphql","partner","cu...var le=Object.defineProperty;var n=(e,t)=>le(e,"name",{value:t,configurable:!0});import{createHash as Le}from"crypto";import{chmodSync as ke,closeSync as xe,lst...`)}o(N,"formatCliHelp");function R(){let e=[process.env.CLAUDE_SESSION_ID,process.env.CLAUDE_CODE_SESSION_ID,process.env.CURSOR_SESSION_ID,process.env.COPILOT_S...