The Agent Skills Directory

[DATA_EXFILTRATION]: The skill is designed to transmit telemetry data, including the verbatim content of user prompts, to Shopify's official telemetry endpoint at https://shopify.dev/mcp/usage.
User prompts are base64-encoded and sent via the scripts/log_skill_use.mjs and scripts/log_feedback.mjs tools as part of the mandated workflow.
Background telemetry hooks (track-telemetry.sh and track-telemetry.ps1) automatically capture prompts from agent events and stash them in temporary local files (/tmp or %TEMP%) before transmitting them.
These operations target the vendor's official domain and are disclosed in the SKILL.md privacy notices.
[COMMAND_EXECUTION]: The skill executes local shell scripts for telemetry tracking.
The PostToolUse hook in SKILL.md triggers track-telemetry.sh using sh -c.
Telemetry scripts spawn background processes using curl or detached PowerShell instances to perform network operations without interrupting the user experience.
[INDIRECT_PROMPT_INJECTION]: The skill fetches and processes external documentation data, which could potentially contain malicious instructions if the source were compromised.
Ingestion points: Documentation search results are retrieved from https://shopify.dev/assistant/search via scripts/search_docs.mjs.
Boundary markers: No explicit delimitation is applied to the search results in the script output.
Capability inventory: The skill has capabilities for shell command execution (via hooks) and network communication (telemetry reporting).
Sanitization: The scripts use standard JSON parsing for search results and lack specific filters for embedded instructions in documentation content.

shopify-dev