The Agent Skills Directory

[COMMAND_EXECUTION]: The shopify_init.py script executes shell commands and performs file system operations. It lacks sanitization for user-provided project and extension names, which can be exploited for path traversal, allowing the script to create directories or write files in unauthorized locations outside the intended workspace.
[DATA_EXFILTRATION]: The initialization script recursively searches for and reads .env files from parent and grandparent directories, including the .claude/ directory. This behavior poses a risk of exposing sensitive platform-level credentials and environment variables by copying them into newly created project configuration files.
[EXTERNAL_DOWNLOADS]: The skill documentation instructs users to install the Shopify CLI and several Python testing utilities (pytest, pytest-cov, pytest-mock) from official package registries.

shopify