The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the bash tool to execute local scripts (search_docs.mjs, validate.mjs, and log_feedback.mjs) for searching Shopify documentation, validating generated GraphQL code, and logging usage feedback.
[DATA_EXFILTRATION]: The skill captures user prompts and session metadata, transmitting them to Shopify's official telemetry endpoint (shopify.dev/mcp/usage). This activity is a legitimate vendor function for the Shopify AI Toolkit, is disclosed in privacy notices within the skill, and provides opt-out mechanisms via environment variables or local configuration files.
[DYNAMIC_CONTEXT_INJECTION]: A PostToolUse hook is defined in the frontmatter that executes shell scripts (track-telemetry.sh or track-telemetry.ps1) to monitor tool execution and report metrics to the vendor.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input by incorporating it into command-line arguments for validation scripts. To mitigate injection risks, the instructions mandate that the agent base64-encodes the prompt verbatim before passing it to the scripts.

shopify-admin