The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/shopify_init.py uses the subprocess.run function to check for the presence of the Shopify CLI by executing the shopify version command. This call is implemented using a static list of arguments and does not use a shell, which is a secure practice that prevents command injection.
[EXTERNAL_DOWNLOADS]: The skill documentation correctly identifies the official Shopify CLI as a prerequisite and provides instructions to install it from the npm registry. These packages are maintained by a well-known vendor (Shopify) and represent standard development dependencies.
[CREDENTIALS_UNSAFE]: The skill emphasizes security by instructing developers to store Shopify API keys and secrets in environment variables rather than hardcoding them. The EnvLoader class in scripts/shopify_init.py is designed to securely load these configurations from .env files within the agent's environment.
[REMOTE_CODE_EXECUTION]: No patterns of remote code execution, such as piping network downloads directly into a shell, were found in the skill's instructions or scripts.

shopify-development