Claude Code, Plugin
Ptai Ecom Toolkit
Claude-Code-Plugin für Shopify-Shops: Audit, audit-light, Monats-Report, Wochen-Puls, Datenabfragen aus Shopify, GA4, Search Console, PageSpeed, DataForSEO, Google Ads und AI-Suche sowie Theme-Migration auf ein aktuelles Theme wie Horizon.
Compatibility: Not stated.
Grade C
One Medium finding. Read the report before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
NETWORK_HOST_FROM_INPUT
Why this grade
- NETWORK_HOST_FROM_INPUT Medium
A file takes a URL or endpoint as input and has no fixed host list.
scripts/ads_client.py, line 76
with urllib.request.urlopen(request, timeout=timeout) as response:
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
scripts/shopify_cli.py, line 50
"""`subprocess.run` mit dem aufgelösten Pfad der CLI an erster Stelle."""
scripts/shopify_cli.py, line 51
return subprocess.run([find_cli(cmd[0]), *cmd[1:]], **kwargs)
scripts/audit/brand.py, line 502
result = subprocess.run(["git", "-C", str(workspace), *args],
Show more
scripts/audit/publish.py, line 550
shutil.rmtree(run_target)
scripts/audit/report_build.py, line 2711
ergebnis = subprocess.run(["bash", str(render), str(goal), str(pdf_ziel)],
scripts/theme/customizations.py, line 180
result = subprocess.run(["git", "-C", str(self.root), *args], capture_output=True, text=True)
scripts/theme/generate.py, line 1130
shutil.rmtree(out / name)
scripts/theme/steps.py, line 124
return subprocess.run(["git", "-C", str(workspace), *args], capture_output=True, text=True, timeout=20)
scripts/theme/steps.py, line 340
result = subprocess.run(["git", "-C", str(workspace), "remote", "get-url", "origin"],
skills/crawl-site/scripts/render_check.py, line 45
result = subprocess.run(["bash", "-c", f'. "{script}"; find_chrome'],
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Serious
accepts a host from input, with no fixed list in this file.
NETWORK_HOST_FROM_INPUT
scripts/ads_client.py, line 76
with urllib.request.urlopen(request, timeout=timeout) as response:
scripts/check_env.sh, line 311
if command -v curl >/dev/null 2>&1; then
scripts/check_env.sh, line 312
ok "Voraussetzung: curl installiert"
Show more
scripts/check_env.sh, line 315
missing "Voraussetzung: curl fehlt (auf macOS vorinstalliert, sonst nachinstallieren)"
scripts/check_env.sh, line 874
if site_html="$(curl -sL --max-time 30 "$CFG_DOMAIN" 2>/dev/null)"; then
scripts/check_env.sh, line 887
hint "GA4-Tag: nicht prüfbar (curl fehlt)"
scripts/check_env.sh, line 1027
crux_body="$(key_header_config "$psi_key" | curl -s --config - --max-time 20 -X POST \
scripts/check_env.sh, line 1038
missing "CrUX-History: nicht prüfbar (curl fehlt)"
scripts/audit/readiness.py, line 628
with urllib.request.urlopen(request, timeout=timeout) as response:
scripts/audit/readiness.py, line 650
code = fetch(row.get(column) or "")
scripts/theme/files.py, line 177
with urllib.request.urlopen(url, timeout=60) as response:
scripts/theme/launch_check.py, line 219
with urllib.request.urlopen(request, timeout=timeout) as response:
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
scripts/check_env.sh, line 24
<workspace-dir> Kunden-Workspace mit reporting/config.json und .env
scripts/check_env.sh, line 36
# Workspace, also gilt ein relativer Pfad aus der .env dort und nicht in dem
scripts/check_env.sh, line 44
ENV_FILE="${WORKSPACE}/.env"
Show more
scripts/check_env.sh, line 51
CENTRAL_ENV="${PTAI_ENV_FILE-${HOME}/.config/ptai-ecom/.env}"
scripts/check_env.sh, line 214
# Wert eines Keys aus einer .env-Datei, mit denselben Leseregeln wie
scripts/check_env.sh, line 246
# Dieselbe Suche wie scripts/audit/env.py: Umgebung, Workspace-.env, zentrale
scripts/check_env.sh, line 248
# aus der Workspace-.env, ein zentraler Fund wäre ein falsches OK.
scripts/check_env.sh, line 318
# git entscheidet unten, ob .env und der Schlüssel des Dienstkontos ignoriert
scripts/audit/publish.py, line 904
key = os.environ.get("SUPABASE_SERVICE_ROLE_KEY")
scripts/audit/release.py, line 53
key = os.environ.get("SUPABASE_SERVICE_ROLE_KEY")
scripts/report/sales/db.mjs, line 31
const KEY = process.env.SUPABASE_SERVICE_ROLE_KEY;
scripts/report/sales/send-report.mjs, line 68
headers: { Authorization: `Bearer ${process.env.RESEND_API_KEY}`, "Content-Type": "application/json" },
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
a file was over the read cap and was not fully read. the file cap was reached before every file was read.
OBFUSCATION_FILE_OVER_READ_CAP OBFUSCATION_FILE_CAP_REACHED
reference/theme-migration/mappings/broadcast-5__horizon-4.json, line 1
{
scripts/theme/sessions.py, line 1
#!/usr/bin/env python3
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 0ffa27f7ec7e. can delete files. accepts a host from input, with no fixed list in this file. reads a credential or environment file. a file was over the read cap and was not fully read. the file cap was reached before every file was read.
Date and source
Date checked:
github.com
Commit graded: 0ffa27f7ec7ea976e24affd4d1944d92c2b855ec
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.