Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/mentilead/shopify-app-skill/add-api-routegit clone --depth 1 https://github.com/mentilead/shopify-app-skillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/mentilead/shopify-app-skill/add-api-route)<a href="https://agentmods.dev/commands/mentilead/shopify-app-skill/add-api-route"><img src="https://agentmods.dev/badge/commands/mentilead/shopify-app-skill/add-api-route.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.00525 |
| Opus 5 | $0.00000 | $0.00262 |
| Sonnet 5 | $0.00000 | $0.00105 |
| Haiku 4.5 | $0.00000 | $0.00052 |
Grade A, and why
add-api-route scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 35 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Add API Route
Scaffold a new React Router route with loader/action, authentication, validation, and tenant scoping.
Arguments
$ARGUMENTS = route description (e.g., "app.settings for shop settings CRUD", "api.export for CSV export endpoint")
Instructions
- Parse the route name and purpose from
$ARGUMENTS. If empty, ask the user what route to create and whether it's anapp.(authenticated admin),api.(headless),proxy.(public), orwebhooks.route. - Read
.claude/skills/shopify-app/references/react-router-patterns.mdfor file naming, loader/action patterns, and revalidation. - Read
.claude/skills/shopify-app/references/security-patterns.mdfor tenant scoping and input validation. - Determine the filename from the route prefix:
app.settings→app/routes/app.settings.tsx(authenticated, has UI)api.export→app/routes/api.export.tsx(headless, action only)proxy.apply→app/routes/proxy.apply.tsx(public, HMAC verified)
- Create the route file with the correct authentication pattern:
app.*routes:authenticate.admin(request)in loader and actionapi.*routes: appropriate auth for the use caseproxy.*routes: HMAC verification viaverifyProxySignature()webhooks.*routes:authenticate.webhook(request)
- For routes with UI (
app.*prefix):- Export
loaderfor data fetching (scope queries bysession.shop) - Export
actionfor mutations (validate input, scope bysession.shop) - Export
defaultcomponent with Polaris UI - Add
shouldRevalidateif the route has POST actions - Read
.claude/skills/shopify-app/references/polaris-ui-patterns.mdfor component patterns
- Export
- For headless routes (
api.*prefix):- Export
actiononly (orloaderfor GET endpoints) - Return JSON responses with proper status codes
- Validate all input parameters
- Export
- Wire up to existing service functions in
app/services/*.server.ts, or create new ones if needed (always withshopDomainas first parameter). - If the route needs navigation, update the
<s-app-nav>inapp/routes/app.tsx.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 35 lines · 0 tokens per session scan A a9c64ff08343
add-api-route is a command published in the GitHub repository mentilead/shopify-app-skill (5 stars, last pushed 6mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 525 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
frontend
Injects context of all relevant cli files.
component
Scaffold a new React component grounded in the paper-mono primitives. Requires explicit kind or a nearest-existing-component match. No empty divs, no speculative scaffolding.
eval-merge
Use the Read tool to load .skill-compass/{skill-name}/manifest.json. Verify.
cti-report
Render case deliverables — relationship graph (PNG/SVG/Mermaid) and a polished PDF/DOCX assessment. Usage: /cti-report [--graph|--pdf].
enum-udp
UDP scan + service follow-up — top ports first, full sweep only when justified.
react-build
Fix React build failures (Vite, webpack, Next.js, CRA, Parcel, esbuild, Bun) incrementally — JSX/TSX compile errors, hydration mismatches, server/client component boundary failures, missing types. Invokes the react-build-resolver agent for minimal, surgical fixes.