The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Fetches the App Bridge library from Shopify's official CDN (cdn.shopify.com) and recommends installing official Shopify packages from the NPM registry.\n- [PROMPT_INJECTION]: The skill implements a workflow for processing external data, which introduces an indirect prompt injection surface.\n
Ingestion points: Data enters the app context via the shopify.resourcePicker callback in SKILL.md, which receives product, collection, and customer metadata from Shopify APIs.\n
Boundary markers: Absent. The skill does not provide instructions to the agent to use delimiters or warnings when processing this external content.\n
Capability inventory: The skill allows for authenticated network requests via fetch, navigation via shopify.navigate, and UI manipulation through modals and toasts.\n
Sanitization: Absent. The provided example code uses innerHTML to directly render metadata into the page.\n- [REMOTE_CODE_EXECUTION]: Example 3 in SKILL.md demonstrates an unsafe coding pattern by using innerHTML to render product.title and other metadata. This facilitates the execution of malicious scripts (XSS) if the data retrieved from the external Shopify resource contains unauthorized script content.

app-bridge