Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add khadinakbarlabs/shopify-app-builder --skill metafields-metaobjectsgit clone --depth 1 https://github.com/khadinakbarlabs/shopify-app-builderWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/khadinakbarlabs/shopify-app-builder/metafields-metaobjects)<a href="https://agentmods.dev/skills/khadinakbarlabs/shopify-app-builder/metafields-metaobjects"><img src="https://agentmods.dev/badge/skills/khadinakbarlabs/shopify-app-builder/metafields-metaobjects.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00083 | $0.04545 |
| Opus 5 | $0.00042 | $0.02273 |
| Sonnet 5 | $0.00017 | $0.00909 |
| Haiku 4.5 | $0.00008 | $0.00455 |
Grade B, and why
metafields-metaobjects scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLmediumData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
const response = await fetch('https://myshop.myshopify.com/api/2026-01/graphql.json', { method: 'POST', How it starts
The opening of the file, as written. The whole thing — 793 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Shopify Metafields and Metaobjects Guide
Metafields vs Metaobjects: When to Use Each
Metafields
Purpose: Store custom key-value data on existing resources (products, orders, customers, etc.)
Use Metafields When:
- Adding custom attributes to existing resources
- Simple key-value relationships
- Data is tightly coupled to the resource
- Needed in themes (Liquid access)
- Examples: size chart URL, custom color, warranty period, gift message
Characteristics:
- Attached to existing resource types
- Simple string or typed values
- Queryable via GraphQL
- Accessible in Liquid templates
- Max 2,500 metafields per resource
- Namespace + key = unique identifier
- Supports display in admin UI via definitions
Metaobjects
Purpose: Define custom data types/records independent of resources
Use Metaobjects When:
- Creating independent data structures
- Multi-field records needed
- Reusable data types across shop
- Complex relationships
- Data referenced by multiple resources
- Examples: FAQs, reviews, testimonials, size guides, lookbooks, staff profiles
Characteristics:
- Independent data type (like custom table)
- Multiple fields with defined types
- Queryable via GraphQL
- Can be referenced by products/collections via metafield
- Organized in admin UI
- Supports indexing and search
- Better for data that stands alone
Comparison Table:
| Feature | Metafield | Metaobject |
|---|---|---|
| Attached to resources | Yes | No (standalone) |
| Multi-field support | No (single value) | Yes |
| Admin UI form | Via definition | Native editor |
| Liquid access | Direct | Via reference metafield |
| Relationship support | One-way (to resource) | One-way (reference metafield) |
| Reusability | Per resource type | Across shop |
| Use case | Quick attributes | Structured data |
Metafield Resource Types
The following resources support metafields:
- Product - 2,500 max metafields per product
- Product Variant - 2,500 max metafields
- Order - Custom order data
- Customer - Customer profiles
- Collection - Collection attributes
- Draft Order - Pre-order metadata
- Shop - Store-wide settings
- Location - Warehouse/store details
- Company - B2B company info
- Company Location - B2B location data
- Market - Market-specific metadata
- File - Asset metadata
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 793 lines · 83 tokens per session scan B 054c403a36bf
metafields-metaobjects is a skill published in the GitHub repository khadinakbarlabs/shopify-app-builder (1 stars, last pushed 28d ago), licensed MIT. It adds 83 tokens to every session and 4,545 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it B with 1 finding (sends data to an external url). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
ebay-search
Search eBay listings - find items, auctions, deals, and compare prices.
ulw-execute
Executes a written Prometheus work plan with Boulder state, evidence ledger, worktree discipline, and parallel subagents. Use when the user says ulw-execute or asks to run a .omo/plans plan.
frontend
Builds, styles, and polishes web UI and UX. Use for any frontend, page, component, styling, layout, animation, or visual-quality task, or when asked to make an interface look or feel a certain way.
review-work
Post-implementation gate review: run manual QA on the real surface yourself, then launch ONE gate reviewer (never a panel) to audit goal, constraints, code quality, security, missed context, and QA evidence. Use before a PR handoff or when the user explicitly asks to review completed work.
lcx-report-bug
Create a high-signal bug issue or PR in the repo that owns the defect. Use this whenever the user asks to report, file, open, or triage a LazyCodex, lazycodex-ai, omo-codex, Codex plugin, or upstream Codex CLI bug, especially when they need source-backed root cause, reproduction steps, fix guidance, and GitHub routing.
remove-deadcode
Remove unused code from this project with ultrawork mode, LSP-verified safety, atomic commits. Triggers: remove dead code, dead code, cleanup, remove unused.