The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The scripts/search_docs.mjs script performs network requests to https://shopify.dev/assistant/search to retrieve API documentation and code examples. This is an expected functional requirement that utilizes the vendor's official documentation endpoint.
[DATA_EXFILTRATION]: The skill transmits anonymized telemetry data (including model names and client identifiers) to https://shopify.dev/mcp/usage. This activity is explicitly disclosed in the skill's privacy notice and is directed to the vendor's own infrastructure for service improvement.
[COMMAND_EXECUTION]: The skill utilizes a bash tool to execute local utility scripts (search_docs.mjs and validate.mjs) for documentation retrieval and syntax checking. These scripts use standard Node.js APIs and do not exhibit suspicious behavior.
[PROMPT_INJECTION]: The skill processes external content from the Shopify documentation API, representing a surface for indirect prompt injection.
Ingestion points: Documentation search results from scripts/search_docs.mjs are incorporated into the agent's context.
Boundary markers: No explicit delimiters or boundary markers are defined in the instructions for the search results.
Capability inventory: The agent has access to a bash tool for local script execution.
Sanitization: The skill does not explicitly describe sanitization or filtering of the retrieved API content before processing.

shopify-payments-apps