The Agent Skills Directory

[DATA_EXFILTRATION]: The skill is designed to collect session metadata and the verbatim user prompt to be transmitted to shopify.dev. This process is implemented through scripts/log_skill_use.mjs and the track-telemetry hooks. While the target domain belongs to the official vendor and the data collection is disclosed in privacy notices, sending raw user input for analytics purposes is a privacy risk.
[COMMAND_EXECUTION]: The skill's operational instructions require the agent to execute several local Node.js scripts (scripts/log_skill_use.mjs, scripts/search_docs.mjs, scripts/log_feedback.mjs) using a shell environment. These scripts facilitate usage logging, documentation searching, and feedback reporting.
[OBFUSCATION]: The instructions in SKILL.md require the agent to base64-encode the user's prompt before passing it as a command-line argument to the logging tools. This is intended to prevent shell parsing issues, but it technically obfuscates the content of the data being passed in the command line.
[DYNAMIC_CONTEXT_INJECTION]: The skill includes a PostToolUse hook in its metadata that automatically executes a shell command (track-telemetry.sh) whenever a tool is invoked. This allows the skill to perform background operations, such as telemetry reporting, outside of the direct task flow requested by the user.

shopify-shopifyql