The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/shopify_init.py programmatically generates project configuration files, including shopify.app.toml, shopify.extension.toml, and package.json, by interpolating user-provided project names and settings into predefined templates. This is a standard and safe implementation of project scaffolding functionality.
[INDIRECT_PROMPT_INJECTION]: The scripts/shopify_init.py script serves as an entry point for untrusted data. 1. Ingestion points: The script prompts for user input for project names and access scopes via the prompt() method. 2. Boundary markers: Absent. 3. Capability inventory: The script can create directories and write files to the local file system. 4. Sanitization: The script lacks explicit sanitization for directory traversal characters in the project name, though the impact is limited to local file creation within the user's current working directory.
[COMMAND_EXECUTION]: The skill performs a benign environment check in scripts/shopify_init.py using subprocess.run(['shopify', 'version']) to verify that the Shopify CLI is installed. This command uses a hardcoded argument list, preventing command injection vulnerabilities.
[CREDENTIALS_UNSAFE]: The skill correctly handles sensitive information by instructing developers to use environment variables for SHOPIFY_API_KEY and SHOPIFY_API_SECRET rather than hardcoding them in the source code. The initialization script provides placeholders and loads values from local .env files, which is a recognized safe practice for development tools.

shopify