Shopify Admin Order Risk Report

---
name: shopify-admin-order-risk-report
role: order-intelligence
description: "Read-only: lists orders by fraud risk level with indicator details for building a manual review queue."
toolkit: shopify-admin, shopify-admin-execution
api_version: "2025-01"
graphql_operations:
  - orders:query
status: stable
compatibility: Claude Code, Cursor, Codex, Gemini CLI
---

## Purpose
Queries recent orders and surfaces those with high or medium fraud risk scores, including the specific risk indicators flagged by Shopify (billing/shipping address mismatch, risky email domain, high-risk IP, etc.). Produces a prioritized review queue for manual fraud assessment. Read-only — no mutations.

## Prerequisites
- Authenticated Shopify CLI session: `shopify store auth --store <domain> --scopes read_orders`
- API scopes: `read_orders`

## Parameters

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| store | string | yes | — | Store domain (e.g., mystore.myshopify.com) |
| risk_level | string | no | high | Minimum risk level to include: `high`, `medium`, or `all` |
| days_back | integer | no | 7 | Lookback window for orders to review |
| min_order_value | float | no | 0 | Only include orders above this value (USD) |
| format | string | no | human | Output format: `human` or `json` |

## Safety

> ℹ️ Read-only skill — no mutations are executed. Safe to run at any time. Risk scores are generated by Shopify's fraud analysis and are advisory only — they do not block orders automatically unless you configure Shopify's fraud filters.

## Workflow Steps

1. **OPERATION:** `orders` — query
   **Inputs:** `query: "risk_level:<risk_level> created_at:>='<NOW - days_back days>'"`, `first: 250`, select `riskLevel`, `riskFacts`, `totalPriceSet`, `customer`, pagination cursor
   **Expected output:** Orders with risk data; paginate until `hasNextPage: false`

2. Sort by risk level (high first), then by order value descending

## GraphQL Operations

```graphql
# orders:query — validated against api_version 2025-01
query OrderRiskReport($query: String!, $after: String) {
  orders(first: 250, after: $after, query: $query) {
    edges {
      node {
        id
        name
        createdAt
        displayFinancialStatus
        displayFulfillmentStatus
        totalPriceSet {
          shopMoney {
            amount
            currencyCode
          }
        }
        riskLevel
        riskFacts {
          message
          sentiment
        }
        customer {
          id
          displayName
          defaultEmailAddress {
            emailAddress
          }
          numberOfOrders
        }
        shippingAddress {
          countryCode
          city
        }
        billingAddress {
          countryCode
          city
        }
      }
    }
    pageInfo {
      hasNextPage
      endCursor
    }
  }
}
```

## Session Tracking

**Claude MUST emit the following output at each stage. This is mandatory.**

**On start**, emit:
```
╔══════════════════════════════════════════════╗
║  SKILL: Order Risk Report                    ║
║  Store: <store domain>                       ║
║  Started: <YYYY-MM-DD HH:MM UTC>             ║
╚══════════════════════════════════════════════╝
```

**After each step**, emit:
```
[N/TOTAL] <QUERY|MUTATION>  <OperationName>
          → Params: <brief summary of key inputs>
          → Result: <count or outcome>
```

**On completion**, emit:

For `format: human` (default):
```
══════════════════════════════════════════════
ORDER RISK REPORT  (<days_back> days)
  Orders reviewed:  <n>
  High risk:        <n>
  Medium risk:      <n>
  Low risk:         <n>

  High Risk Orders:
    #<name>  $<amount>  <customer>
      Risks: <indicator>, <indicator>
  Output: risk_report_<date>.csv
══════════════════════════════════════════════
```

For `format: json`, emit:
```json
{
  "skill": "order-risk-report",
  "store": "<domain>",
  "period_days": 7,
  "orders_reviewed": 0,
  "high_risk_count": 0,
  "medium_risk_count": 0,
  "output_file": "risk_report_<date>.csv"
}
```

## Output Format
CSV file `risk_report_<YYYY-MM-DD>.csv` with columns:
`order_name`, `order_id`, `created_at`, `risk_level`, `total_price`, `currency`, `customer_name`, `customer_email`, `risk_indicators`, `financial_status`, `fulfillment_status`

## Error Handling
| Error | Cause | Recovery |
|-------|-------|----------|
| `THROTTLED` | API rate limit exceeded | Wait 2 seconds, retry up to 3 times |
| No high-risk orders | Clean period | Exit with summary: 0 flagged orders |
| `riskLevel` null | Order too new for analysis | Exclude from report, note count |

## Best Practices
- Do not auto-cancel high-risk orders — use `high-risk-order-tagger` to flag them for manual hold first, then review before cancelling.
- An order from a repeat customer (`numberOfOrders > 3`) with a high risk score is usually a false positive — apply judgment before acting.
- `min_order_value` helps focus review effort on high-value fraud risk; $50+ is a reasonable floor for most stores.
- Run daily as part of a morning ops routine, especially during high-volume sale periods when fraud attempts increase.