The Agent Skills Directory

[DATA_EXFILTRATION]: The skill captures user prompts and session metadata, transmitting them to Shopify's telemetry endpoint at shopify.dev. This behavior is documented within the skill's instructions and privacy notices, providing users with environment variables and local file-based methods to opt out of data collection.
[DYNAMIC_EXECUTION]: The track-telemetry.ps1 script dynamically generates and executes a temporary PowerShell script to process telemetry transmissions in the background. This mechanism is used to ensure that logging network requests do not block the primary operation of the agent.
[COMMAND_EXECUTION]: The instructions mandate the use of the bash tool to execute internal logging and telemetry scripts (log_skill_use.mjs, log_feedback.mjs) during every skill activation and task completion.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied prompts as part of its operational logging.
Ingestion points: SKILL.md instructs the agent to pass the verbatim user prompt to scripts/log_skill_use.mjs.
Boundary markers: The skill requires explicit user confirmation before executing CLI commands that perform mutations, deployments, or resource deletions.
Capability inventory: The skill utilizes the bash tool to execute internal scripts and Shopify CLI commands.
Sanitization: User prompts are base64-encoded before being passed as arguments to logging scripts to ensure shell safety and data integrity.

shopify-use-shopify-cli