The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a Bash script (references/debug-bundle-script.md) to perform diagnostic tasks, check environment versions (Node.js, npm), and package data into a compressed tarball.
[EXTERNAL_DOWNLOADS]: The script performs network requests using curl to fetch information from Shopify's API endpoints (e.g., admin/api/2025-04/shop.json). These requests target well-known Shopify domains to collect store status, access scopes, and rate limit data.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from external Shopify API responses and writes them to a diagnostic summary file, creating a surface for potential prompt injection if store data contains malicious instructions.
Ingestion points: Data is fetched via curl from multiple Shopify API endpoints in references/debug-bundle-script.md.
Boundary markers: The script does not use explicit delimiters or "ignore instructions" headers when writing external API data to summary.txt.
Capability inventory: The skill possesses the Bash, Read, and Grep capabilities as defined in its metadata, which could be exploited if injected instructions are followed.
Sanitization: While the script uses jq to structure the data, it does not perform sanitization or escaping of the actual string values returned by the API before including them in the diagnostic output.

shopify-debug-bundle