Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add khadinakbarlabs/shopify-app-builder --skill shopify-functionsgit clone --depth 1 https://github.com/khadinakbarlabs/shopify-app-builderWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/khadinakbarlabs/shopify-app-builder/shopify-functions)<a href="https://agentmods.dev/skills/khadinakbarlabs/shopify-app-builder/shopify-functions"><img src="https://agentmods.dev/badge/skills/khadinakbarlabs/shopify-app-builder/shopify-functions/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/khadinakbarlabs/shopify-app-builder/shopify-functions"><img src="https://agentmods.dev/badge/skills/khadinakbarlabs/shopify-app-builder/shopify-functions.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00151 | $0.06732 |
| Opus 5 | $0.00076 | $0.03366 |
| Sonnet 5 | $0.00030 | $0.01346 |
| Haiku 4.5 | $0.00015 | $0.00673 |
Grade A, and why
shopify-functions scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 986 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Shopify Functions
Shopify Functions are WebAssembly (WASM) units of business logic that extend the Shopify checkout, order, and fulfillment pipelines. They execute in a sandboxed runtime on Shopify's servers and have strict constraints: 5ms execution window, 256KB binary limit, no async I/O, no outbound HTTP to unknown hosts, and 30-point GraphQL query complexity ceiling.
Architecture & Execution Model
Function Lifecycle:
- Merchant installs your app; metafield definitions are registered
- App reads merchant configuration from metafields (Shop, Product, Collection scopes)
- On checkout/order event, Shopify invokes your function with Input JSON payload
- Function executes WASM bytecode, applies business logic, returns JSON output
- Output mutations are applied atomically to the checkout/order state
Execution Constraints (Hard Limits):
- Max execution time: 5ms (timeout failure = no operation)
- Max binary size: 256KB gzipped
- Max instructions: 11 million
- Max memory: 256KB heap
- Max output JSON: 256KB
- Max GraphQL query complexity: 30 points (estimate 1pt per simple field)
- No async I/O, no event loops, no multi-threading
- No network access except allowed_hosts (NEW 2025-01)
- Deterministic execution only
Why WASM? Shopify Functions run in Wasmtime, a fast WebAssembly runtime. This provides:
- Language flexibility: Compile Rust, JavaScript (via AssemblyScript), or Go to WASM
- Isolation: No access to host filesystem, process, or network (except whitelisted hosts)
- Performance: Near-native execution speed; optimized just-in-time compilation
- Security: Sandboxed; input/output validation by Shopify platform
Function Targets & Checkout Pipeline
The Shopify checkout and order pipeline has 8 invocation points (targets). Each target receives a specific input schema and must return a specific output schema:
| Target | Phase | Purpose | Input | Output | Latency Budget |
|---|---|---|---|---|---|
cart.transform.run |
1. Cart | Transform line items (bundle, rename, change quantity) | Cart items, metafields | Modified items | 5ms |
cart.checkout-validation.run |
2. Validation | Validate cart before payment (inventory, rules) | Cart state, attributes | Errors/blocks (optional) | 5ms |
cart.delivery-customization.run |
3. Delivery | Customize rates, hide options, rank (shipping, pickup) | Delivery options, cart | Customized rates/ranking | 5ms |
cart.payment-customization.run |
4. Payment | Hide payment methods, customize amounts | Payment methods, total | Customized methods/amounts | 5ms |
discount.run |
5. Discount | Apply discounts (% off, $ off, free shipping, gift) | Cart items, rules | Discount targets + value | 5ms |
fulfillment-constraints.run |
6. Fulfillment | Constrain what locations can fulfill each line | Cart items, locations | Location fulfillment rules | 5ms |
order.routing.location.rank.run |
7. Order Routing | Rank locations for fulfillment (priority, cost) | Locations, order lines | Ranked location order | 5ms |
localization.generate.run |
8. Localization | Generate translated/localized checkout labels | Buyer locale, shop context | Localized strings | 5ms |
cart.lines.discounts.generate.run |
5b. Line Discounts | NEW 2025+: Per-line discounts with allocation strategy | Line items, rules | Per-line discounts with allocation | 5ms |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 986 lines · 151 tokens per session scan A f45d4b647193
shopify-functions is a skill published in the GitHub repository khadinakbarlabs/shopify-app-builder (1 stars, last pushed 1mo ago), licensed MIT. It adds 151 tokens to every session and 6,732 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
nft-standards
Implement NFT standards (ERC-721, ERC-1155) with proper metadata handling, minting strategies, and marketplace integration. Use when creating NFT contracts, building NFT marketplaces, or implementing digital asset systems.
ebay-search
Search eBay listings - find items, auctions, deals, and compare prices.
ulw-execute
Executes a written Prometheus work plan with Boulder state, evidence ledger, worktree discipline, and parallel subagents. Use when the user says ulw-execute or asks to run a .omo/plans plan.
frontend
Builds, styles, and polishes web UI and UX. Use for any frontend, page, component, styling, layout, animation, or visual-quality task, or when asked to make an interface look or feel a certain way.
review-work
Post-implementation gate review: run manual QA on the real surface yourself, then launch ONE gate reviewer (never a panel) to audit goal, constraints, code quality, security, missed context, and QA evidence. Use before a PR handoff or when the user explicitly asks to review completed work.
lcx-report-bug
Create a high-signal bug issue or PR in the repo that owns the defect. Use this whenever the user asks to report, file, open, or triage a LazyCodex, lazycodex-ai, omo-codex, Codex plugin, or upstream Codex CLI bug, especially when they need source-backed root cause, reproduction steps, fix guidance, and GitHub routing.