The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill describes methods for fetching and displaying data from Shopify stores, such as product titles, customer information, and order notes, which are managed through GraphQL and REST APIs. This ingestion of external data constitutes a surface for indirect prompt injection attacks.
Ingestion points: Data is retrieved via Shopify GraphQL Admin API calls, as detailed in references/app-development.md and reference/graphql-admin-api.md.
Boundary markers: While the documentation emphasizes security best practices, the provided code examples do not explicitly demonstrate the use of delimiters or guardrail instructions when interpolating store data into UI components.
Capability inventory: The skill utilizes the Shopify CLI for project initialization and file management, and supports network requests to external services from UI extensions.
Sanitization: Best practices in reference/ui-extensions.md explicitly recommend sanitizing user input and verifying session tokens.
[EXTERNAL_DOWNLOADS]: The skill provides instructions for installing the Shopify CLI and various platform-specific packages.
Evidence: Installation commands like npm install -g @shopify/cli@latest are found in SKILL.md.
Context: These downloads are directed toward official Shopify tools and registries, which are well-known and trusted services.
[COMMAND_EXECUTION]: The documentation includes several CLI commands for development, testing, and deployment.
Evidence: Commands such as shopify app dev, shopify app deploy, and shopify theme push are used in SKILL.md and reference/cli-commands.md.
Context: These are legitimate tools required for Shopify development and are used in accordance with the skill's primary purpose.

shopify