OpenAI Codex security directory

Shopify

Published by Shopify

High risk

Helps manage Shopify stores and develop Shopify apps or storefronts. Work with products, inventory, discounts, orders, customer details and store analytics. Developer workflows cover APIs, themes, extensions, custom data and checkout integrations.

Security assessment

Plutonium assessed this plugin for permissions, capabilities, and security-relevant behavior.

  • Can scaffold, deploy and create Shopify application/store resources: Can deploy code, applications, containers, workflows, or infrastructure to a persistent environment.
  • Generates and rewrites app, theme, extension and temporary data files: Can read, create, or change files on the local filesystem or in a selected project.
  • Can send data to external services: Can send prompts, files, queries, or connected-service data to an external service.
  • Can change persistent data or access: Can create or change persistent records, files, projects, permissions, settings, or credentials.
  • Can execute code, commands, or queries: Can execute code, commands, scripts, unrestricted queries, or dynamic gateway actions.
  • UCP workflow can complete checkout and place an order: Can initiate purchases, paid jobs, payments, refunds, infrastructure spend, or other financial activity.

Available capabilities

This add-on exposes 20 tools or capabilities.

  • shopify-admin
  • shopify-app-store-review
  • shopify-custom-data
  • shopify-customer
  • shopify-dev
  • shopify-functions
  • shopify-hydrogen
  • shopify-liquid
  • shopify-onboarding-dev
  • shopify-onboarding-merchant
  • shopify-partner
  • shopify-payments-apps
  • shopify-polaris-admin-extensions
  • shopify-polaris-app-home
  • shopify-polaris-checkout-extensions
  • shopify-polaris-customer-account-extensions
  • shopify-pos-ui
  • shopify-storefront-graphql
  • shopify-use-shopify-cli
  • ucp

The interactive security report will load automatically.