What can an AI agent do with
Add scripts to your storefront?
It can add JavaScript from another website to your storefront pages. Adding scripts to the order status page is an older option that Shopify has deprecated. This only works with older vintage themes.
How to spot it
On a Shopify connection or settings screen, this is write_script_tags.
With it, an agent can
- Add outside JavaScript to your storefront pages
- Read the script tags already on your store
It cannot, on its own
- It only works with vintage themes, not newer themes
What a bad day looks like
If it adds a script from a bad source, that code runs on your store pages in front of every shopper.
Set it up safer
- Grant read_script_tags if it only needs to check what is installed
Ask the company selling the agent
- What script will it add, and where is it hosted?
- Will you remove the script if I uninstall?
Source
Checked against Shopify documentation on 2026-09-28. All Shopify permissions →
Thinking about a specific agent?
Tell us what it connects to, what it is allowed to do and who approves its work. You get a plain-language label of what it can touch and what to ask the seller. It takes a couple of minutes, and your answers stay in your browser unless you choose to post a test job.
Or have a person go through the AI apps on up to 3 of your business services with you and get a written report, for $249.
This page explains what a permission allows. It does not describe, test or rate any product. Permission details are summarized in our own words from the provider's documentation, linked on the page; providers change their documentation, so check the source before you rely on a detail.