optimize-shopify-alt-text

SUSPICIOUS. The Shopify functionality is mostly coherent and routes to official Shopify tooling/APIs, but the mandatory unpinned `npx skills update` on every trigger is a significant supply-chain and transitive-trust risk because it refreshes the skill and bundled helper before approval. No clear evidence of credential theft or malicious exfiltration is present, but the forced updater makes the skill materially riskier than a normal Shopify admin helper.