Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/mentilead/shopify-app-skillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/mentilead/shopify-app-skill/setup-local-dev)<a href="https://agentmods.dev/commands/mentilead/shopify-app-skill/setup-local-dev"><img src="https://agentmods.dev/badge/commands/mentilead/shopify-app-skill/setup-local-dev/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/mentilead/shopify-app-skill/setup-local-dev"><img src="https://agentmods.dev/badge/commands/mentilead/shopify-app-skill/setup-local-dev.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.00523 |
| Opus 5.5 | $0.00000 | $0.00209 |
| Sonnet 5.5 | $0.00000 | $0.00105 |
| Haiku 4.5 | $0.00000 | $0.00052 |
Grade A, and why
setup-local-dev scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 42 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Setup Local Dev
Verify and configure the local development environment for a Shopify embedded app.
Arguments
$ARGUMENTS = optional flags (e.g., "reset" to start fresh, "check" to only verify without changes)
Instructions
- Read
.claude/skills/shopify-app/references/local-dev-patterns.mdfor Docker Compose setup, startup sequence, and environment variables. - Read
.claude/skills/shopify-app/SKILL.mdfor key environment variables table and gotcha #10 (cached store association). - Run pre-flight checks:
- Verify Docker is installed and running:
docker info - Verify Node.js version matches requirements:
node --version - Verify Shopify CLI is installed:
shopify version - Verify npm dependencies are installed: check
node_modules/exists - Check if
docker-compose.ymlexists in the project root
- Verify Docker is installed and running:
- If
$ARGUMENTScontains "check", report the status of each check and stop. Do not make changes. - Start infrastructure services:
- Run
docker compose up -dto start DynamoDB Local, DynamoDB Admin, and LocalStack - Wait for services to be healthy: check ports 8000 (DynamoDB), 8001 (Admin), 4566 (LocalStack)
- Run
- Set up the
.envfile if it doesn't exist:- Copy from
.env.exampleif available - Ensure these local development values are set:
DYNAMODB_ENDPOINT=http://localhost:8000AWS_S3_ENDPOINT=http://localhost:4566EMAIL_QUEUE_URLpointing to LocalStack SQS
- Ask the user for
SHOPIFY_API_KEYandSHOPIFY_API_SECRETif not set
- Copy from
- Create the DynamoDB table if it doesn't exist:
- Run
npm run setupor the table creation script - Verify the table was created via DynamoDB Admin at http://localhost:8001
- Run
- If
$ARGUMENTScontains "reset":- Warn the user this will delete local data
- Run
docker compose down -vto remove volumes - Restart from step 5
- Report the final status:
- List all running services and their ports
- Confirm
.envis configured - Confirm DynamoDB table exists
- Print the next step:
shopify app devto start the app
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 42 lines · 0 tokens per session scan A 71274a7203d1
setup-local-dev is a command published in the GitHub repository mentilead/shopify-app-skill (6 stars, last pushed 7mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 523 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
dev
Runs Vendure in development mode. By default it starts three processes: the GraphQL server (ts-node ./src/index.ts), the worker (ts-node ./src/index-worker.ts), and the dashboard (a Vite dev server).
cti-report
Render case deliverables — relationship graph (PNG/SVG/Mermaid) and a polished PDF/DOCX assessment. Usage: /cti-report [--graph|--pdf].
enum-udp
UDP scan + service follow-up — top ports first, full sweep only when justified.
check
Run TYPO3 conformance check on current extension.
kerberos
Kerberos attacks — AS-REP roasting and Kerberoasting.
intake
You are running the intake for this purchase. The goal is to populate spec.md at the repo root with the per-purchase brief.