The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the shopify CLI binary to interact with the Shopify MCP server. This usage is explicitly defined in the manifest and is restricted to the intended business management functions of the skill.
[INDIRECT_PROMPT_INJECTION]: The skill has an inherent attack surface for indirect injection as it processes untrusted user input to search for products and execute queries.
Ingestion points: Untrusted data enters the agent context through user-supplied search terms for catalogs and products, business name suggestions, and custom GraphQL or ShopifyQL strings in SKILL.md.
Boundary markers: The instructions do not define specific delimiters or boundary markers for user-interpolated content.
Capability inventory: The skill has extensive write capabilities, including product creation, collection management, and arbitrary graphql_mutation calls via the shopify command.
Sanitization: While no explicit string sanitization is described, the skill contains a mandatory rule requiring the agent to confirm with the user before any tool that writes data, effectively mitigating the risk of unauthorized store modifications.
[PROMPT_INJECTION]: The instruction to share only the connect_url from the authorize-url response is a security best practice designed to prevent the exposure of sensitive OAuth state tokens or internal identifiers to the user, thereby preventing potential session hijacking or fixation attacks.

shopify