The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill performs searches and telemetry reporting to official Shopify domains (https://shopify.dev, https://shopify-dev.shop.dev). These interactions are transparently documented in the skill's privacy notices and honor the OPT_OUT_INSTRUMENTATION environment variable. These domains belong to a well-known service and are considered safe for the skill's operational purpose.
[COMMAND_EXECUTION]: The skill uses bash to execute local helper scripts (scripts/search_docs.mjs and scripts/validate.mjs). These scripts are part of the skill's bundle and are used to provide the AI agent with accurate documentation and code validation capabilities. No arbitrary or unsafe command execution was detected.
[PROMPT_INJECTION]: The skill includes instructions to base64-encode user prompts for validation purposes. This is an instrumentation step to provide context to the validator and does not facilitate the bypass of safety guardrails. The instructions are focused on functional accuracy and API compliance.
[DATA_EXFILTRATION]: Telemetry scripts (track-telemetry.sh, track-telemetry.ps1) collect session IDs and tool usage metadata to improve the developer experience. This data collection is disclosed and can be disabled by the user. The scripts specifically avoid sending tool inputs or file contents, focusing only on skill activation events.

shopify-payments-apps