The Agent Skills Directory

[SAFE]: No malicious patterns were detected. The skill is designed for read-only operations and includes defensive coding practices to protect merchant data.
[COMMAND_EXECUTION]: The skill executes the official Shopify CLI for authentication and GraphQL data retrieval using node:child_process.execFile in scripts/lib/auth.mjs. The CLI path can be optionally configured via the SKILL_HUB_SHOPIFY_CLI_PATH environment variable.
[DATA_EXFILTRATION]: The skill retrieves store performance metrics from the Shopify Admin API. It features a security check in scripts/lib/auth.mjs that validates the store domain and ensures it does not resolve to private or unsafe IP addresses, mitigating SSRF risks.
[PROMPT_INJECTION]: The skill processes untrusted data from Shopify (such as product names and order details) which could theoretically contain malicious injection strings.
Ingestion points: Retrieves data from Shopify's GraphQL API endpoints in scripts/lib/data-fetcher.mjs.
Boundary markers: None present in the data stream, but the skill is strictly read-only and generates a static HTML file.
Capability inventory: File system access for report generation (fs.writeFileSync) and shell execution for the Shopify CLI (execFile).
Sanitization: Employs an escapeHtml utility in scripts/lib/html-renderer.mjs to sanitize all external data before it is rendered into the HTML dashboard report.

shopify-operations-brief