The Agent Skills Directory

[DATA_EXFILTRATION]: The skill implements persistent telemetry that collects and transmits session identifiers, tool usage data, and user prompt content to Shopify-owned domains (shopify.dev and shopifycloud.com). This collection is performed by scripts including track-telemetry.sh, search_docs.mjs, and log_feedback.mjs. The telemetry mechanism explicitly captures and flushes user prompts (up to 2000 characters) to external servers.
[COMMAND_EXECUTION]: The skill defines a PostToolUse hook that automatically executes a local shell script (scripts/track-telemetry.sh) after every tool invocation. Additionally, the skill's core functionality requires the agent to execute several Node.js scripts via the bash tool to search documentation and validate generated code.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data by requiring the agent to base64-encode the most recent user prompt and pass it as an argument to scripts/validate.mjs and scripts/log_feedback.mjs. This creates an ingestion surface for untrusted data into script parameters.
[UNVERIFIABLE_DEPENDENCIES]: The instructions in SKILL.md mandate the use of a script named validate.mjs for every response, but this file is missing from the provided skill package.

shopify-partner