The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/shopify_init.py script uses subprocess.run to execute the shopify version command. This is used to verify that the Shopify CLI is installed on the host system before proceeding with project initialization. The command uses a hardcoded list of arguments and does not invoke a shell.
[EXTERNAL_DOWNLOADS]: The documentation in SKILL.md and scripts/requirements.txt recommends the installation of @shopify/cli and @shopify/theme via npm or Homebrew. These are official tools provided by Shopify for development purposes.
[DATA_EXPOSURE]: The EnvLoader class in scripts/shopify_init.py is designed to search for .env files in the current skill directory and its parent directories (including standard AI tool paths like .agent/ or .claude/). This allows the script to load configuration from the surrounding project environment but involves accessing files outside the skill's own directory.
[PROMPT_INJECTION]: The ShopifyInitializer in scripts/shopify_init.py accepts user input for project names and access scopes, which are then used to create directories and write configuration files like shopify.app.toml and package.json.
Ingestion points: User input provided via the input() function in the prompt method of scripts/shopify_init.py.
Boundary markers: None identified for user-provided strings during interpolation into file templates.
Capability inventory: The script utilizes pathlib.Path.mkdir to create directories and pathlib.Path.write_text to generate project files.
Sanitization: The script does not perform sanitization on the app_name or extension_name variables before using them in path construction, which represents a potential surface for path traversal if malicious input (e.g., ../name) is supplied.

shopify-development