Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/khadinakbarlabs/shopify-app-builder/cursorgit clone --depth 1 https://github.com/khadinakbarlabs/shopify-app-builderWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/khadinakbarlabs/shopify-app-builder/cursor)<a href="https://agentmods.dev/agents/khadinakbarlabs/shopify-app-builder/cursor"><img src="https://agentmods.dev/badge/agents/khadinakbarlabs/shopify-app-builder/cursor.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.00355 |
| Opus 5 | $0.00000 | $0.00178 |
| Sonnet 5 | $0.00000 | $0.00071 |
| Haiku 4.5 | $0.00000 | $0.00036 |
Grade A, and why
cursor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Cursor guide
Cursor can consume the native .cursor-plugin/plugin.json package surface or install the shared Agent Skills collection directly.
Install
Until the plugin is accepted into Cursor's public marketplace, use the portable installation path:
npx skills add khadinakbarlabs/shopify-app-builder --skill '*' --agent cursor --copy --yes
The repository already includes the Cursor manifest needed for marketplace submission and compatible direct-plugin tooling.
Best use cases
- In-editor implementation of Polaris, App Bridge, Remix, and Shopify API flows.
- Reviewing selected files or diffs for scopes, HMAC handling, GraphQL errors, and UX anti-patterns.
- Generating small extensions or webhook handlers while keeping the active code context visible.
- Applying focused Shopify guidance during Composer or Agent workflows.
Operating guidelines
- Reference a skill by name in the prompt when the automatic trigger is ambiguous.
- Include the relevant configuration, route, extension, or schema files in context; do not ask the agent to infer them.
- Request a focused diff and verification command for each change.
- Do not paste live secrets into chat or accept a deployment/publication action without explicit approval.
- Re-check unstable Shopify facts against official documentation.
Example prompts
Use polaris-ui and ux-polaris-antipatterns to review the selected route.
Use app-auth to fix this token-exchange handler without widening scopes.
Use ux-empty-error-states to implement loading, empty, and partial-failure states here.
Verify
Start a new Cursor Agent chat and ask it to use using-shopify-app-builder. Confirm it can read the installed skill and route a webhook request to webhooks plus app-auth.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 41 lines · 0 tokens per session scan A ee7ec7718cb2
cursor is an agent published in the GitHub repository khadinakbarlabs/shopify-app-builder (1 stars, last pushed 25d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 355 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
agents-directory
Developer reference for all 11 Oh My OpenAgent agent definitions, factory patterns, tool restrictions, and model routing.
momus
Momus is a practical work plan reviewer. Its job is to answer one question.
hephaestus
Hephaestus is a goal-oriented autonomous executor. Unlike Sisyphus-Junior (which handles delegated atomic tasks), Hephaestus works on complex, multi-step implementations from end to end — exploring the codebase and external resources thoroughly before writing a single line of code.
multimodal-looker
Multimodal Looker is a read-only media interpretation agent. It receives a file path and a goal describing what to extract, then returns only the relevant extracted information. The main agent never processes the raw file — Multimodal Looker saves context tokens by doing the interpretation work instead.
comments
agent with frontmatter comments.
mainframe-react-frontend-engineer
Use for client-facing React web applications and client React layers inside full-stack frameworks: pages, components, forms, interactions, accessibility, browser data, API integration, PWA and offline behavior, realtime UI, rich content, visualizations, frontend tests, and incremental refactoring. Not for React…