The Agent Skills Directory

[SAFE]: The skill manages credentials using environment variables and local .env files, which is a standard and secure practice for API tools.
[COMMAND_EXECUTION]: The skill utilizes standard system commands curl and jq to perform its intended tasks. These are used as expected for an API-focused skill.
[EXTERNAL_DOWNLOADS]: The skill interacts with the well-known Shopify service (myshopify.com) to fetch store data and download bulk reports. These network operations are intrinsic to its documented purpose.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting untrusted data from the Shopify API.
Ingestion points: External data such as product titles, descriptions, and customer details are retrieved via GraphQL queries (found in SKILL.md).
Boundary markers: The templates do not use specific delimiters or instructions to treat fetched content as untrusted data.
Capability inventory: The skill has the ability to perform network requests (curl) and write data to the local file system (e.g., products.jsonl).
Sanitization: No evidence of data sanitization or filtering was found in the provided command patterns.

shopify