Skills shopify-development
📦
shopify-development
Content revision r1 High Risk ⚙️ External commands🌐 Network access🔑 Env variables📁 Filesystem access
Build Shopify Apps, Extensions, and Themes
Shopify development spans apps, extensions, APIs, themes, and compliance details. This skill gives Claude, Codex, and Claude Code focused patterns for real Shopify work.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "shopify-development" from https://skillstore.io/skills/sickn33-shopify-development.md and its manifest at https://skillstore.io/api/skills/sickn33-shopify-development/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "shopify-development". User asks how to add a gift message to checkout.
Expected outcome:
The skill recommends a checkout UI extension, identifies the target, lists required state, and describes attribute update behavior.
Using "shopify-development". User asks how to sync products from Shopify.
Expected outcome:
The skill outlines GraphQL product queries, pagination, scopes, rate limit handling, and webhook updates for changed products.
Using "shopify-development". User asks how to customize a product page.
Expected outcome:
The skill suggests Liquid section and snippet changes, product form considerations, image handling, and theme preview steps.
Security Audit
High Riskv5 • 7/7/2026 Open versioned report
Most static findings are documentation or test false positives from Markdown backticks, Liquid syntax, placeholder URLs, and dummy credentials. The real risks are in optional helper scripts that read local credentials, load parent .env files, write API keys into generated configuration, and send access tokens to a caller-controlled Shopify host.
9
Files scanned
3,333
Lines analyzed
28
Review items
0
False positives ignored
Confirmed security concerns (15)
High
Environment file access
Load environment variables from .env file.
The initializer implements .env file discovery and parsing for Shopify credentials. This is intended configuration behavior, but it can read sensitive local files from parent directories.
High
Environment file access
filepath: Path to .env file
The initializer implements .env file discovery and parsing for Shopify credentials. This is intended configuration behavior, but it can read sensitive local files from parent directories.
High
Environment file access
Get list of .env file paths in priority order.
The initializer implements .env file discovery and parsing for Shopify credentials. This is intended configuration behavior, but it can read sensitive local files from parent directories.
High
Environment file access
Priority: process.env > skill/.env > skills/.env > agent_dir/.env
The initializer implements .env file discovery and parsing for Shopify credentials. This is intended configuration behavior, but it can read sensitive local files from parent directories.
High
Environment file access
List of .env file paths
The initializer implements .env file discovery and parsing for Shopify credentials. This is intended configuration behavior, but it can read sensitive local files from parent directories.
High
Environment file access
# skill/.env
The initializer implements .env file discovery and parsing for Shopify credentials. This is intended configuration behavior, but it can read sensitive local files from parent directories.
High
Environment file access
skill_env = skill_dir / '.env'
The initializer implements .env file discovery and parsing for Shopify credentials. This is intended configuration behavior, but it can read sensitive local files from parent directories.
High
Environment file access
# skills/.env
The initializer implements .env file discovery and parsing for Shopify credentials. This is intended configuration behavior, but it can read sensitive local files from parent directories.
Show all 15 confirmed findings
High
Environment file access
skills_env = skill_dir.parent / '.env'
The initializer implements .env file discovery and parsing for Shopify credentials. This is intended configuration behavior, but it can read sensitive local files from parent directories.
High
Environment file access
# agent_dir/.env (e.g., .agent, .claude, .gemini, .cursor)
The initializer implements .env file discovery and parsing for Shopify credentials. This is intended configuration behavior, but it can read sensitive local files from parent directories.
High
Environment file access
agent_env = skill_dir.parent.parent / '.env'
The initializer implements .env file discovery and parsing for Shopify credentials. This is intended configuration behavior, but it can read sensitive local files from parent directories.
High
Environment file access
Priority: process.env > skill/.env > skills/.env > agent_dir/.env
The initializer implements .env file discovery and parsing for Shopify credentials. This is intended configuration behavior, but it can read sensitive local files from parent directories.
High
Environment file access
# Load from .env files (reverse priority order)
The initializer implements .env file discovery and parsing for Shopify credentials. This is intended configuration behavior, but it can read sensitive local files from parent directories.
High
Unvalidated API Host Receives Access Token
ShopifyGraphQL accepts a shop_domain string, strips only the scheme, builds a URL from it, and later sends X-Shopify-Access-Token to that host. A hostile or mistyped domain could receive an Admin API token.
The code directly combines caller-controlled shop_domain with the token-bearing request header. The risk depends on caller input, but the unsafe trust boundary is clear.
High
Parent Environment Files Can Populate Generated Config
The initializer searches .env files in the skill, parent skills directory, and parent agent directory, then can place the configured Shopify API key into generated shopify.app.toml content. This can propagate secrets outside their original storage location.
The file discovery, credential loading, and generated config write are all present in the script. The exposure requires running the helper, so confidence is high but not absolute.
Capability review items (28)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Generic API/secret keys
if 'SHOPIFY_API_KEY' in env_vars:
The script copies Shopify API key or secret values from .env files or process environment into runtime configuration. This is legitimate setup behavior but handles sensitive credentials.
High
Generic API/secret keys
config.shopify_api_key = env_vars['SHOPIFY_API_KEY']
The script copies Shopify API key or secret values from .env files or process environment into runtime configuration. This is legitimate setup behavior but handles sensitive credentials.
High
Generic API/secret keys
if 'SHOPIFY_API_SECRET' in env_vars:
The script copies Shopify API key or secret values from .env files or process environment into runtime configuration. This is legitimate setup behavior but handles sensitive credentials.
High
Generic API/secret keys
config.shopify_api_secret = env_vars['SHOPIFY_API_SECRET']
The script copies Shopify API key or secret values from .env files or process environment into runtime configuration. This is legitimate setup behavior but handles sensitive credentials.
High
Generic API/secret keys
if 'SHOPIFY_API_KEY' in os.environ:
The script copies Shopify API key or secret values from .env files or process environment into runtime configuration. This is legitimate setup behavior but handles sensitive credentials.
High
Generic API/secret keys
config.shopify_api_key = os.environ['SHOPIFY_API_KEY']
The script copies Shopify API key or secret values from .env files or process environment into runtime configuration. This is legitimate setup behavior but handles sensitive credentials.
High
Generic API/secret keys
if 'SHOPIFY_API_SECRET' in os.environ:
The script copies Shopify API key or secret values from .env files or process environment into runtime configuration. This is legitimate setup behavior but handles sensitive credentials.
High
Generic API/secret keys
config.shopify_api_secret = os.environ['SHOPIFY_API_SECRET']
The script copies Shopify API key or secret values from .env files or process environment into runtime configuration. This is legitimate setup behavior but handles sensitive credentials.
High
Generic API/secret keys
client_id = "{self.config.shopify_api_key or 'YOUR_API_KEY'}"
The script writes the configured Shopify API key into generated shopify.app.toml content. That can leak a real credential if the generated project is shared or committed.
Medium
Python HTTP libraries
from urllib.request import Request, urlopen
The helper builds an HTTPS Shopify GraphQL endpoint and uses urllib to send requests. This is intended functionality, but it is outbound network behavior with credentials.
Medium
Hardcoded URL
self.base_url = f"https://{self.shop_domain}/admin/api/{API_VERSION}/graphql.json"
The helper builds an HTTPS Shopify GraphQL endpoint and uses urllib to send requests. This is intended functionality, but it is outbound network behavior with credentials.
Medium
Python environment access
shop = os.environ.get('SHOP_DOMAIN', 'your-store.myshopify.com')
The example main function reads SHOP_DOMAIN and SHOPIFY_ACCESS_TOKEN from process environment. Those values can include an Admin API token used for network requests.
Medium
Python environment access
token = os.environ.get('SHOPIFY_ACCESS_TOKEN', '')
The example main function reads SHOP_DOMAIN and SHOPIFY_ACCESS_TOKEN from process environment. Those values can include an Admin API token used for network requests.
Medium
Hidden file access
Priority: process.env > skill/.env > skills/.env > agent_dir/.env
The initializer searches hidden .env files in the skill, parent skills, and agent directories. Reading parent hidden configuration can expose credentials beyond the new project scope.
Medium
Hidden file access
# skill/.env
The initializer searches hidden .env files in the skill, parent skills, and agent directories. Reading parent hidden configuration can expose credentials beyond the new project scope.
Medium
Hidden file access
# skills/.env
The initializer searches hidden .env files in the skill, parent skills, and agent directories. Reading parent hidden configuration can expose credentials beyond the new project scope.
Medium
Hidden file access
# agent_dir/.env (e.g., .agent, .claude, .gemini, .cursor)
The initializer searches hidden .env files in the skill, parent skills, and agent directories. Reading parent hidden configuration can expose credentials beyond the new project scope.
Medium
Hidden file access
Priority: process.env > skill/.env > skills/.env > agent_dir/.env
The initializer searches hidden .env files in the skill, parent skills, and agent directories. Reading parent hidden configuration can expose credentials beyond the new project scope.
Low
Environment variable object
Priority: process.env > skill/.env > skills/.env > agent_dir/.env
The line documents the script priority for process environment and .env files, which is implemented in the same file. It is a low-confidence but real indicator of local credential access.
Low
Environment variable object
Priority: process.env > skill/.env > skills/.env > agent_dir/.env
The line documents the script priority for process environment and .env files, which is implemented in the same file. It is a low-confidence but real indicator of local credential access.
Low
Python environment access
if 'SHOPIFY_API_KEY' in os.environ:
The script reads SHOPIFY_API_KEY, SHOPIFY_API_SECRET, SHOP_DOMAIN, and SCOPES from process environment. This is intended, but it directly handles credential-bearing environment variables.
Low
Python environment access
config.shopify_api_key = os.environ['SHOPIFY_API_KEY']
The script reads SHOPIFY_API_KEY, SHOPIFY_API_SECRET, SHOP_DOMAIN, and SCOPES from process environment. This is intended, but it directly handles credential-bearing environment variables.
Low
Python environment access
if 'SHOPIFY_API_SECRET' in os.environ:
The script reads SHOPIFY_API_KEY, SHOPIFY_API_SECRET, SHOP_DOMAIN, and SCOPES from process environment. This is intended, but it directly handles credential-bearing environment variables.
Low
Python environment access
config.shopify_api_secret = os.environ['SHOPIFY_API_SECRET']
The script reads SHOPIFY_API_KEY, SHOPIFY_API_SECRET, SHOP_DOMAIN, and SCOPES from process environment. This is intended, but it directly handles credential-bearing environment variables.
Low
Python environment access
if 'SHOP_DOMAIN' in os.environ:
The script reads SHOPIFY_API_KEY, SHOPIFY_API_SECRET, SHOP_DOMAIN, and SCOPES from process environment. This is intended, but it directly handles credential-bearing environment variables.
Low
Python environment access
config.shop_domain = os.environ['SHOP_DOMAIN']
The script reads SHOPIFY_API_KEY, SHOPIFY_API_SECRET, SHOP_DOMAIN, and SCOPES from process environment. This is intended, but it directly handles credential-bearing environment variables.
Low
Python environment access
if 'SCOPES' in os.environ:
The script reads SHOPIFY_API_KEY, SHOPIFY_API_SECRET, SHOP_DOMAIN, and SCOPES from process environment. This is intended, but it directly handles credential-bearing environment variables.
Low
Python environment access
config.scopes = os.environ['SCOPES']
The script reads SHOPIFY_API_KEY, SHOPIFY_API_SECRET, SHOP_DOMAIN, and SCOPES from process environment. This is intended, but it directly handles credential-bearing environment variables.
Risk Factors
⚙️ External commands (56)
references/app-development.md:36-38 references/app-development.md:44-57 references/app-development.md:89-93 references/app-development.md:102-116 references/app-development.md:116-121 references/app-development.md:527-529 references/extensions.md:510-518 scripts/shopify_init.py:196 scripts/shopify_init.py:296-302 scripts/shopify_init.py:302-306 scripts/shopify_init.py:306-309 scripts/tests/test_shopify_init.py:173 scripts/tests/test_shopify_init.py:178 SKILL.md:26 SKILL.md:29 SKILL.md:32 SKILL.md:43-45 SKILL.md:45-49 SKILL.md:49-53 SKILL.md:53-57 SKILL.md:57-63 SKILL.md:63-67 SKILL.md:67-72 SKILL.md:72-78 SKILL.md:78-80 SKILL.md:80-83 SKILL.md:83-87 SKILL.md:87 SKILL.md:88 SKILL.md:89 SKILL.md:90 SKILL.md:91 SKILL.md:99-125 SKILL.md:125-129 SKILL.md:129-148 SKILL.md:148-152 SKILL.md:152-167 SKILL.md:167-171 SKILL.md:171-183 SKILL.md:183-189 SKILL.md:189-233 SKILL.md:233-239 SKILL.md:239-257 SKILL.md:257-263 SKILL.md:263-265 SKILL.md:265-282 SKILL.md:282-292 SKILL.md:292-308 SKILL.md:308-318 SKILL.md:318-327 SKILL.md:327-346 SKILL.md:346-347 SKILL.md:347-348 SKILL.md:348-354 SKILL.md:354 SKILL.md:355
🌐 Network access (28)
references/app-development.md:44 references/app-development.md:85 references/app-development.md:101 references/app-development.md:12 references/app-development.md:36 references/app-development.md:44 references/app-development.md:102 references/app-development.md:372 references/app-development.md:411 references/extensions.md:191 references/extensions.md:508 references/extensions.md:508 references/themes.md:426 references/themes.md:438 references/themes.md:443 references/themes.md:326 scripts/shopify_graphql.py:135 scripts/shopify_graphql.py:182 scripts/shopify_graphql.py:234 scripts/shopify_graphql.py:20 scripts/shopify_graphql.py:70 scripts/shopify_init.py:218 scripts/shopify_init.py:313 scripts/shopify_init.py:314 SKILL.md:361 SKILL.md:362 SKILL.md:363 SKILL.md:364
🔑 Env variables (56)
references/app-development.md:48 references/app-development.md:49 references/app-development.md:295 references/app-development.md:48 references/app-development.md:49 references/app-development.md:295 references/app-development.md:13 references/app-development.md:48 references/app-development.md:49 references/app-development.md:295 scripts/shopify_graphql.py:404 scripts/shopify_graphql.py:405 scripts/shopify_init.py:68 scripts/shopify_init.py:101 scripts/shopify_init.py:124 scripts/shopify_init.py:125 scripts/shopify_init.py:126 scripts/shopify_init.py:127 scripts/shopify_init.py:128 scripts/shopify_init.py:129 scripts/shopify_init.py:130 scripts/shopify_init.py:131 scripts/shopify_init.py:21 scripts/shopify_init.py:22 scripts/shopify_init.py:114 scripts/shopify_init.py:115 scripts/shopify_init.py:116 scripts/shopify_init.py:117 scripts/shopify_init.py:124 scripts/shopify_init.py:125 scripts/shopify_init.py:126 scripts/shopify_init.py:127 scripts/shopify_init.py:217 scripts/tests/test_shopify_init.py:106 scripts/tests/test_shopify_init.py:27 scripts/tests/test_shopify_init.py:28 scripts/tests/test_shopify_init.py:36 scripts/tests/test_shopify_init.py:37 scripts/tests/test_shopify_init.py:45 scripts/tests/test_shopify_init.py:46 scripts/tests/test_shopify_init.py:51 scripts/tests/test_shopify_init.py:52 scripts/tests/test_shopify_init.py:103 scripts/tests/test_shopify_init.py:104 scripts/tests/test_shopify_init.py:106 scripts/tests/test_shopify_init.py:110 scripts/tests/test_shopify_init.py:118 scripts/tests/test_shopify_init.py:119 scripts/tests/test_shopify_init.py:131 scripts/tests/test_shopify_init.py:132 scripts/tests/test_shopify_init.py:362 scripts/tests/test_shopify_init.py:363 scripts/tests/test_shopify_init.py:370 scripts/tests/test_shopify_init.py:371 scripts/tests/test_shopify_init.py:376 scripts/tests/test_shopify_init.py:377
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-shopify-development/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-shopify-development?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-shopify-development?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-shopify-development/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-shopify-development.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). shopify-development security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-shopify-development/audits/5BibTeX citation
@techreport{sickn33-sickn33-shopify-development-2026,
author = {sickn33},
title = {shopify-development security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/sickn33-shopify-development/audits/5},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "shopify-development security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/sickn33-shopify-development/audits/5"
identifiers:
- type: other
value: "skillstore:sickn33-shopify-development:audit:5"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 82
Architecture
85
Maintainability
87
Content
70
Community
83
Spec Compliance
What You Can Build
Plan an Embedded Shopify App
Use OAuth, scopes, GraphQL, webhook, billing, and project structure guidance to design an app implementation.
Build Storefront Theme Features
Use Liquid, sections, snippets, product forms, and cart patterns to customize storefront behavior.
Create Commerce UI Extensions
Use checkout, admin, POS, customer account, and Function examples to plan targeted merchant experiences.
Try These Prompts
Choose the Shopify Build Type
I need to build a Shopify feature for [goal]. Decide whether this should be an app, extension, theme change, or combined approach.
Design an App Integration
Plan a Shopify app that uses [data or workflow]. Include scopes, OAuth flow, webhooks, GraphQL operations, and deployment steps.
Implement an Extension Experience
Design a Shopify [checkout, admin, POS, or customer account] extension for [merchant task]. Include target, data needs, UI flow, and API calls.
Review a Production Shopify Build
Review my Shopify implementation plan for security, API limits, webhooks, billing, theme impact, and app review readiness.
Best Practices
- Request the smallest Shopify access scopes that support the feature.
- Validate webhook HMAC signatures and OAuth state values before processing requests.
- Check Shopify API versions and GraphQL query costs before production deployment.
Avoid
- Do not hardcode merchant credentials, access tokens, or secrets in app or theme files.
- Do not build checkout changes as theme code when Shopify requires an extension.
- Do not process large stores without pagination, retries, and rate limit handling.
Frequently Asked Questions
What Shopify work does this skill support?
It supports apps, UI extensions, themes, GraphQL Admin API work, webhooks, billing, metafields, and Shopify Functions.
Does it include executable code?
Yes. It includes Python helper scripts for project initialization and GraphQL calls, plus tests for the initializer.
Can it help with Shopify CLI workflows?
Yes. It lists common Shopify CLI commands for apps, extensions, themes, previews, and deployments.
Does it validate Shopify credentials?
No. Users must provide valid credentials and handle credential storage securely in their own environment.
Is the reference code production ready?
No. It is a starting point and needs project-specific validation, security checks, logging, and tests.
Which AI tools are supported?
The report lists support for Claude, Codex, and Claude Code.
Developer Details
Author
sickn33License
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Repository
https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/shopify-developmentRef
9f814fc6a43fd99946f2da5e0df231c65a38bc76
Maintenance freshness
7/18/2026
Usage
14 downloads · 192 views
File structure