The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references local development tunnels using the lhr.life domain (localhost.run). Automated scanners flagged these URLs as potentially malicious, which is common for dynamic forwarding services that are occasionally abused by malicious actors. In this context, the URLs serve as placeholders for the output of the shopify app dev command.
[COMMAND_EXECUTION]: The instructions involve standard command-line operations for a development environment, such as npm install -g @shopify/cli, shopify app init, and troubleshooting scripts like node <plugin-root>/scripts/reset-shopify-cache.mjs.
[DATA_EXFILTRATION]: The skill guides the user to set up local tunnels (via Cloudflare, ngrok, or lhr.life) to receive Shopify webhooks. This process exposes a local development port to the internet, which is a standard but noteworthy ingress point for external data.
[PROMPT_INJECTION]: The skill defines a workflow for processing external data from Shopify webhooks, which constitutes an Indirect Prompt Injection surface.
Ingestion points: Webhook callback routes defined in shopify.server.ts and associated files in app/routes/api/webhooks/.
Boundary markers: The documentation correctly recommends using HMAC signature validation to verify the authenticity of incoming requests.
Capability inventory: The environment includes file system access via the Prisma ORM and the ability to execute CLI tools.
Sanitization: Relies on the implementation of signature verification and standard payload handling as recommended in the documentation.

shopify-cli