Shopify checkout hijack check
ctrlaltdylan/checkout-hijack-scan
Opens your store in a fresh browser session, adds a product, clicks Checkout and records where the shopper lands and which third-party scripts load, to catch injected code sending buyers to a phishing page. Stops at checkout and fills in nothing.
Review notes
MReviewed by moveset · 2026-10-28 · version b13476a · added by editors
- Heads-up
- The indicator list covers only the October 2026 campaign (3 domains and a few session keys). A PASS doesn't rule out other attacks; rerun after installing apps.
- Good for
- Worried that custom JS in an app sends buyers to a fake checkout.
- Not for
- Stores you don't own, or a full security audit.
Install
From the GitHub repository ctrlaltdylan/storefront-skills at commit b13476a, take only the plugins/storefront-sec/skills/checkout-hijack-scan folder and put it in this project's .agents/skills/checkout-hijack-scan/ (for Claude Code, also copy it to .claude/skills/checkout-hijack-scan/). Don't run its scripts yet; tell me where you installed it and what it needs.
Pinned to b13476a (2026-10-15), the version we reviewed and scanned
Installs come from the author's repository, not through moveset. Once the author claims it and hosts it on moveset, moveset install will work and deliver updates.
What it touches
- Files
- 3 files, 21 KBSKILL.md, 1 Node script and 1 indicator list
- Runtime
- Node.js 18+ with Playwright 1.63.0 and Chromium in a temp folder; a browser-only mode also exists
- Network
- Visits your store in a browser and goes as far as Shopify checkout
- Scan
- Passed, nothing blocked · same scan rules as moveset's own skillsNo addresses found in the files
Author's description
Checks a Shopify store for checkout hijacking, where injected JavaScript sends shoppers to a fake checkout that steals card details.checkout-hijack-scan · SKILL.md · ctrlaltdylan/storefront-skills@b13476a
Wrong description, broken link or a security issue? Tell usDon't want to be listed? Ask for removal · handled within two business days
Similar skills
All community skills →Built a skill for cross-border sellers?
Free skills can be submitted today and appear here once reviewed. Authors already listed can claim their page and maintain it; the best can ship a Pro edition with us for a royalty.