The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/shopify_init.py utilizes subprocess.run() to verify if the Shopify CLI is installed on the system. The command executed is hardcoded as ['shopify', 'version'], which is a standard safety check and does not allow for arbitrary command injection.
[CREDENTIALS_UNSAFE]: The initialization script reads environment variables (such as SHOPIFY_API_KEY and SHOPIFY_API_SECRET) from .env files to automatically populate local project configuration files. This is standard behavior for development scaffolding tools and the data is handled locally without being transmitted over the network.
[SAFE]: The documentation files (references/, SKILL.md) contain standard Shopify development patterns, including OAuth flows and API usage, following official Shopify best practices.
[SAFE]: The .coverage files included in the scripts/ directory are standard binary artifacts generated by the Python coverage tool during testing and do not contain executable logic or malicious data.

shopify