The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/shopify_init.py script executes a version check using subprocess.run(['shopify', 'version']). This call is restricted to a static command list and does not use a shell, preventing command injection.\n- [EXTERNAL_DOWNLOADS]: The documentation and setup scripts reference the installation of the official Shopify CLI via NPM. Shopify is a well-known and trusted service provider, and these downloads are standard for the intended development workflow.\n- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the development of apps that ingest data from Shopify webhooks and API endpoints (e.g., product titles, order details). While this introduces an ingestion surface for untrusted data, the skill includes explicit best practices for mitigation:\n
Ingestion points: Data is received via GraphQL queries in shopify_graphql.py and webhook handlers in references/app-development.md.\n
Boundary markers: None explicitly defined for agent context, but instructions advise developer-level validation.\n
Capability inventory: The skill provides file-writing capabilities in shopify_init.py for project setup and network operations in shopify_graphql.py for API interaction.\n
Sanitization: The references/extensions.md guide specifically mandates sanitizing user input and verifying HMAC signatures to maintain data integrity.

shopify-development