shopify
Enables interaction with Shopify's Admin and Storefront GraphQL APIs using curl for managing products, orders, and customers.
Install this skill
Security score
The shopify skill was audited on May 23, 2026 and we found 17 security issues across 4 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 68 | ```bash |
Template literal with variable interpolation in command context
| 304 | ```bash |
Webhook reference - potential data exfiltration
| 337 | ## Webhooks |
Webhook reference - potential data exfiltration
| 343 | mutation($topic: WebhookSubscriptionTopic!, $sub: WebhookSubscriptionInput!) { |
Webhook reference - potential data exfiltration
| 344 | webhookSubscriptionCreate(topic: $topic, webhookSubscription: $sub) { |
Webhook reference - potential data exfiltration
| 345 | webhookSubscription { id topic endpoint { __typename ... on WebhookHttpEndpoint { callbackUrl } } } |
Webhook reference - potential data exfiltration
| 348 | }' '{"topic":"ORDERS_CREATE","sub":{"callbackUrl":"https://example.com/webhook","format":"JSON"}}' |
Webhook reference - potential data exfiltration
| 351 | Verify incoming webhook HMAC using the app's client secret (not the access token): |
Access to hidden dotfiles in home directory
| 39 | 4. Save to `~/.hermes/.env`: |
Access to .env file
| 39 | 4. Save to `~/.hermes/.env`: |
External URL reference
| 25 | homepage: https://shopify.dev/docs/api/admin-graphql |
External URL reference
| 59 | - **Endpoint:** `https://$SHOPIFY_STORE_DOMAIN/admin/api/$SHOPIFY_API_VERSION/graphql.json` |
External URL reference
| 73 | "https://${SHOPIFY_STORE_DOMAIN}/admin/api/${SHOPIFY_API_VERSION:-2026-01}/graphql.json" \ |
External URL reference
| 107 | Query syntax supports `title:`, `sku:`, `vendor:`, `product_type:`, `status:active`, `tag:`, `created_at:>2025-01-01`. Full grammar: https://shopify.dev/docs/api/usage/search-syntax |
External URL reference
| 300 | - **Endpoint:** `https://$SHOPIFY_STORE_DOMAIN/api/$SHOPIFY_API_VERSION/graphql.json` |
External URL reference
| 306 | "https://${SHOPIFY_STORE_DOMAIN}/api/${SHOPIFY_API_VERSION:-2026-01}/graphql.json" \ |
External URL reference
| 348 | }' '{"topic":"ORDERS_CREATE","sub":{"callbackUrl":"https://example.com/webhook","format":"JSON"}}' |