shopify-development
Enables the development of Shopify apps, extensions, and themes using GraphQL and Liquid for enhanced e-commerce functionality.
Install this skill
Security score
The shopify-development skill was audited on Feb 28, 2026 and we found 22 security issues across 2 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Webhook reference - potential data exfiltration
| 6 | "shopify theme", "liquid template", "polaris", "shopify graphql", "shopify webhook", |
Webhook reference - potential data exfiltration
| 18 | - Implementing webhooks or billing |
Webhook reference - potential data exfiltration
| 261 | ## Webhook Configuration |
Webhook reference - potential data exfiltration
| 266 | [webhooks] |
Webhook reference - potential data exfiltration
| 269 | [[webhooks.subscriptions]] |
Webhook reference - potential data exfiltration
| 271 | uri = "/webhooks/orders" |
Webhook reference - potential data exfiltration
| 273 | [[webhooks.subscriptions]] |
Webhook reference - potential data exfiltration
| 275 | uri = "/webhooks/products" |
Webhook reference - potential data exfiltration
| 277 | # GDPR mandatory webhooks (required for app approval) |
Webhook reference - potential data exfiltration
| 278 | [webhooks.privacy_compliance] |
Webhook reference - potential data exfiltration
| 279 | customer_data_request_url = "/webhooks/gdpr/data-request" |
Webhook reference - potential data exfiltration
| 280 | customer_deletion_url = "/webhooks/gdpr/customer-deletion" |
Webhook reference - potential data exfiltration
| 281 | shop_deletion_url = "/webhooks/gdpr/shop-deletion" |
Webhook reference - potential data exfiltration
| 299 | - Always verify webhook HMAC signatures before processing |
Webhook reference - potential data exfiltration
| 330 | **IF webhook is not receiving events:** |
Webhook reference - potential data exfiltration
| 331 | → Verify the webhook URL is publicly accessible |
Webhook reference - potential data exfiltration
| 333 | → Review webhook logs in Partner Dashboard |
Webhook reference - potential data exfiltration
| 346 | - `references/app-development.md` - OAuth authentication flow, GraphQL mutations for products/orders/billing, webhook handlers, billing API integration |
External URL reference
| 361 | - Shopify Developer Docs: https://shopify.dev/docs |
External URL reference
| 362 | - GraphQL Admin API Reference: https://shopify.dev/docs/api/admin-graphql |
External URL reference
| 363 | - Shopify CLI Reference: https://shopify.dev/docs/api/shopify-cli |
External URL reference
| 364 | - Polaris Design System: https://polaris.shopify.com |