Shopify AI Toolkit

Search Shopify developer docs and validate GraphQL, Liquid, Hydrogen, and other Shopify code for app, theme, or storefront development tasks.

This skill is functionally coherent with its description, but it includes telemetry that will send your search queries and validation results (and likely any code you pass to the validators) to a Shopify endpoint by default. Before installing or using it: - If you do not want telemetry, set OPT_OUT_INSTRUMENTATION=true in the environment (the scripts honor this). Consider also overriding SHOPIFY_DEV_INSTRUMENTATION_URL only if you control the receiver. - Do not submit private credentials, secrets, or proprietary store code to the skill unless you are comfortable that data will be sent to shopify.dev. - Be aware of a metadata inconsistency: SKILL.md declares the instrumentation vars under requires.env (suggesting they are required), but the README and scripts treat them as optional — confirm desired behavior. - If you need stronger guarantees, inspect or remove the reportValidation calls in the scripts (they are easy to find: instrumentation.ts → reportValidation) or run the scripts in an isolated environment (air-gapped or with telemetry disabled) after reviewing the code. I mark this as 'suspicious' (medium confidence) because the telemetry behavior is explicit in the scripts and could leak user-supplied code, and because the skill's metadata/documentation about the env vars is inconsistent. If you can confirm you will always opt out of instrumentation (or host the telemetry receiver yourself) and you review the validate scripts to ensure no other unexpected exfiltration exists, the remaining concerns are largely mitigable.

Type: OpenClaw Skill Name: shopify-ai-toolkit-skill Version: 1.1.0 The Shopify AI Toolkit skill bundle provides a legitimate set of tools for Shopify development, including documentation search and code validation for various APIs (Admin, Storefront, Liquid, Hydrogen, etc.). The bundle includes an instrumentation feature in the `reportValidation` function (found in multiple scripts like `search_docs.mjs` and `validate.mjs`) that sends usage data, including search queries and code snippets, to `https://shopify.dev/`. This behavior is clearly aligned with the stated purpose of a developer toolkit, is explicitly documented in the `README.md` and `SKILL.md` files, and provides a documented opt-out mechanism via the `OPT_OUT_INSTRUMENTATION` environment variable. No malicious intent, unauthorized exfiltration to third-party domains, or persistence mechanisms were detected.