An app proxy route that reads logged_in_customer_id but never checks the signature parameter lets anyone call it directly and read another customer's points, wishlist or orders. A webhook route that never checks X-Shopify-Hmac-Sha256 accepts fake orders/create and customers/redact events from anyone who finds the URL. A VITE_SHOPIFY_ADMIN_API_TOKEN ships your Admin token to every visitor. This skill finds those and ten other Shopify app mistakes before you deploy, and tells you how to fix each one.

Your agent runs a scanner on shopify.app.toml and shopify.app.*.toml, shopify.extension.toml and shopify.theme.toml, .env files, Shopify config YAML and JSON (for token prefixes), and JavaScript, TypeScript, Python, Ruby and PHP code that mentions Shopify (React Router and Remix templates, Express, Next.js, Flask, Rails, Laravel). It knows what the official libraries verify for you (authenticate.webhook, authenticate.public.appProxy, shopify.webhooks.validate, processWebhooks, validateHmac with the appProxy signator, ShopifyApp::WebhookVerification and AppProxyVerification, PHP Registry::process, the older Shopify.Webhooks.Registry.process and Koa receiveWebhook), says REVIEW instead of BLOCK when a check may live in middleware or a router it cannot read, and in a folder scan follows a verifying helper defined in another file, whether it is called, passed as route middleware or used as a decorator. It checks API versions against Shopify's 12-month support window using the date of the scan. It reads .gitignore, so a secret in a .env file that git ignores is counted in one line instead of reported. Comments and test files are skipped and nothing is run or sent to Shopify. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Tokens and secrets are never printed.

What it checks

BLOCK (fix before shipping)

• H01: shpat_, shpca_, shppa_, shpss_, shprt_ or shptka_ tokens, client secrets and Admin or private Storefront tokens written in code, config or env files git would commit (JavaScript, TypeScript, Python, Ruby and PHP forms), including literal fallbacks for env variables
• H02: a file that builds the whole request path and handles Shopify webhooks with nothing that checks X-Shopify-Hmac-Sha256
• H03: the same for app proxy handlers that never check the signature parameter
• H04: Admin tokens, private Storefront tokens or the client secret in browser-exposed variables (NEXT_PUBLIC_, VITE_, PUBLIC_, REACT_APP_, EXPO_PUBLIC_ and others)

REVIEW (check before release)

• H11: a production app config that does not subscribe to all three mandatory compliance webhooks while the app lists some of them, handles one in code or declares App Store distribution (the template default, which the finding names)
• H12: restricted or approval-only scopes: read_all_orders, write_themes, read_users, payment mandate, gateway and session scopes, read_customer_payment_methods, own subscription contract scopes
• H13: Admin, Storefront or webhook API versions Shopify no longer supports, or unstable
• H14: use_legacy_install_flow = true
• H15: localhost, Cloudflare or ngrok tunnel, or plain http URLs in a deployed app config
• H16: webhook or app proxy handlers whose signature check, if any, sits in middleware, a router or a helper the scan cannot follow
• H17: hand-made HMAC checks that compare with == or sign re-serialized JSON instead of the raw body
• H18: hand-made OAuth callbacks with no visible hmac, state nonce or anchored shop domain check (client credentials, token exchange and refresh-token requests are left alone)
• H19: deprecated script tags (write_script_tags, scriptTagCreate, scriptTagUpdate, REST ScriptTag)

What's included

• The scanner (Python 3.9+, standard library only)
• A rules guide with the reason, safer approach and Shopify documentation link for each rule
• A risky and a safe example Shopify app (app config, extension config, React Router server file, Express backend, router, helper and env file), and the real report the scanner produces on the risky one

Limits

It reads each file as written: settings made in the Dev Dashboard or Partner Dashboard, environment values and middleware or helpers outside the scanned folder are not seen. Code that never names Shopify, a Shopify header or logged_in_customer_id is not read. Liquid theme files and Go or Java apps are not checked, and YAML or JSON files are read for token prefixes only. Whether an app is listed in the App Store cannot be known from files, so the compliance check needs signs from the project. Results for API versions change as Shopify retires them. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 25 files: SKILL.md, the scanner in scripts/ (8 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (14 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.