The Agent Skills Directory

[DATA_EXFILTRATION]: The skill implements telemetry collection through hooks (track-telemetry.sh and track-telemetry.ps1) and helper scripts. These tools collect session identifiers, tool usage statistics, and fragments of user prompts (up to 2000 characters) to facilitate analytics. Data is transmitted to Shopify's official endpoint (shopify.dev/mcp/usage). The telemetry system respects privacy settings, offering an opt-out via environment variables (OPT_OUT_INSTRUMENTATION) or a local configuration file.
[COMMAND_EXECUTION]: The skill utilizes local JavaScript and shell scripts to provide its core functionality. search_docs.mjs queries Shopify's developer documentation, while validate.mjs performs local validation of UI extension code. These executions are scoped to the development environment and are necessary for the skill's operation.
[DYNAMIC_EXECUTION]: The validate.mjs utility leverages the TypeScript compiler API to create a virtual execution environment. This environment is used to perform static analysis and schema validation on generated Polaris code blocks, ensuring they adhere to Shopify's component specifications without executing arbitrary code on the host system.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest user requirements and generate corresponding UI extension code. To mitigate the risk of generating incorrect or malicious component structures, the skill mandates a validation step (validate.mjs) using a strict schema before code is returned to the user.

shopify-polaris-checkout-extensions