The Agent Skills Directory

[COMMAND_EXECUTION]: Uses standard shell commands including curl, jq, and openssl to interact with APIs, process JSON data structures, and verify HMAC signatures for Shopify webhooks.
[EXTERNAL_DOWNLOADS]: Downloads data payloads from official Shopify GraphQL endpoints during bulk operations, specifically saving results to local .jsonl files for processing.
[DATA_EXFILTRATION]: Transmits Shopify merchant data, such as product catalogs and customer order history, to the official Bankr agent API (api.bankr.bot) to facilitate integrated loyalty drops and payment settlement workflows.
[PROMPT_INJECTION]: Identifies a potential indirect prompt injection surface where customer-controlled data from Shopify metafields (e.g., social handles) is interpolated into natural language prompts for the Bankr agent.
Ingestion points: Customer metafields (namespace: custom, key: handle) are read from Shopify stores via the shop_gql helper in SKILL.md (Bridges 1 and 3).
Boundary markers: Absent; external data is directly embedded into the prompt string without explicit delimiters.
Capability inventory: Interacts with the api.bankr.bot/agent/prompt endpoint to execute onchain actions such as USDC transfers and loyalty token drops.
Sanitization: None provided in the template code; the implementation assumes the retrieved metafield value adheres to expected handle formats.

bankr-shopify