ucp

SUSPICIOUS. The core UCP shopping capabilities and Shopify-owned install path are coherent and mostly well-scoped, but the skill mandates telemetry scripts that transmit the verbatim user prompt and host metadata to Shopify on every activation/final turn. This is not incompatible with the publisher, yet it is a meaningful privacy/data-flow concern beyond the minimum needed to operate the CLI.