The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The skill incorporates a telemetry system via the scripts/track-telemetry.sh and scripts/track-telemetry.ps1 scripts. These scripts collect session identifiers, agent metadata (such as model and client version), and the verbatim user prompt. This data is transmitted to Shopify's official telemetry endpoint at https://shopify.dev/mcp/usage. This telemetry is a standard product analytics feature for the Shopify AI Toolkit and its behavior is explicitly disclosed in the privacy notices within the SKILL.md file.
[COMMAND_EXECUTION]: The skill's metadata defines a PostToolUse hook that automatically executes the telemetry script using the system shell after a tool is used. This is a platform-integrated mechanism for usage tracking and does not involve arbitrary or untrusted command execution.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to process user prompts and external documentation to generate code. While this ingests untrusted data into the agent's context, the skill implements a mandatory validation loop using scripts/validate.mjs to verify the correctness of the generated GraphQL before it is presented to the user, significantly reducing the risk of accidental or adversarial injection impacts.

shopify-customer