Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add mentilead/shopify-app-skill --skill shopify-appgit clone --depth 1 https://github.com/mentilead/shopify-app-skillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mentilead/shopify-app-skill/shopify-app)<a href="https://agentmods.dev/skills/mentilead/shopify-app-skill/shopify-app"><img src="https://agentmods.dev/badge/skills/mentilead/shopify-app-skill/shopify-app.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00052 | $0.02353 |
| Opus 5 | $0.00026 | $0.01177 |
| Sonnet 5 | $0.00010 | $0.00471 |
| Haiku 4.5 | $0.00005 | $0.00235 |
Grade A, and why
shopify-app scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 272 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CRITICAL GOTCHAS (Top 10)
1. Never Use Polaris url Prop for Internal Navigation
// WRONG — breaks out of iframe
<Button url="/app/pricing">Upgrade</Button>
// CORRECT — stays in iframe
const navigate = useNavigate();
<Button onClick={() => navigate('/app/pricing')}>Upgrade</Button>
Rule: url prop is only safe for external URLs. Use useNavigate() for internal routes.
2. Never Use NODE_ENV for Billing isTest Flag
// WRONG — always false on Lambda (staging included)
isTest: process.env.NODE_ENV !== 'production'
// CORRECT — detect via Shopify API
isTest: await isDevelopmentStore(admin)
3. useFetcher Data Goes to fetcher.data, Not useActionData()
// WRONG — always undefined when using fetcher
const actionData = useActionData<typeof action>();
// CORRECT — read from fetcher
const fetcher = useFetcher();
const fetcherData = fetcher.data as { ok?: boolean; error?: string } | undefined;
4. useState Doesn't Sync with Loader After Save
// WRONG — state diverges from loader after save
const [brandColor, setBrandColor] = useState(settings.brandColor);
// CORRECT — sync from loader when data changes
const lastSyncRef = useRef(settings.updatedAt);
useEffect(() => {
if (settings.updatedAt !== lastSyncRef.current) {
setBrandColor(settings.brandColor);
lastSyncRef.current = settings.updatedAt;
}
}, [settings.updatedAt, settings.brandColor]);
5. Parent + Child Loaders Run in Parallel (Billing Race Condition)
// CORRECT — redirect after billing sync to force clean second load
const url = new URL(request.url);
if (url.searchParams.has('charge_id')) {
url.searchParams.delete('charge_id');
throw redirect(url.pathname + url.search);
}
6. App Proxy: GET Only, No External CSS/JS
| Constraint | Detail |
|---|---|
| GET only | Proxy only forwards GET. POST must go directly to the app URL. |
| No external CSS/JS | <link> and <script src> resolve against storefront domain and 404. |
No Tailwind ?inline |
Tailwind 4's Vite plugin doesn't process @tailwind for ?inline imports. |
| No client-side hydration | React Router JS bundles don't load through the proxy. |
What ships with it
16 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/app-proxy-patterns.md 4.2 KB
- references/billing-patterns.md 5.0 KB
- references/cdk-infrastructure.md 4.5 KB
- references/dynamodb-patterns.md 5.6 KB
- references/email-patterns.md 2.8 KB
- references/feature-exploration.md 10 KB
- references/lambda-architecture.md 4.2 KB
- references/local-dev-patterns.md 5.0 KB
- references/polaris-ui-patterns.md 7.9 KB
- references/production-deployment.md 11 KB
- references/project-conventions.md 7.1 KB
- references/react-router-patterns.md 6.8 KB
- references/security-patterns.md 3.8 KB
- references/shopify-api-patterns.md 3.5 KB
- references/testing-patterns.md 3.9 KB
- references/webhook-patterns.md 4.0 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 272 lines · 52 tokens per session scan A 5078020fd316
shopify-app is a skill published in the GitHub repository mentilead/shopify-app-skill (5 stars, last pushed 6mo ago), licensed MIT. It adds 52 tokens to every session and 2,353 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
aceternity-ui
100+ animated React components (Aceternity UI) for Next.js with Tailwind. Use for hero sections, parallax, 3D effects, or encountering animation, shadcn CLI integration errors.
cloudflare-nextjs
Deploy Next.js to Cloudflare Workers via the OpenNext adapter (@opennextjs/cloudflare). Use for SSR/ISR/SSG/App or Pages Router, getCloudflareContext, bindings (D1/R2/KV/AI/Hyperdrive), caching tiers, skew protection, multi-worker, custom worker, env vars, or worker…
auto-animate
AutoAnimate (@formkit/auto-animate) zero-config animations for React. Use for list transitions, accordions, toasts, or encountering SSR errors, animation libraries complexity.
base-ui-react
MUI Base UI unstyled React components with Floating UI. Use for accessible components, Radix UI migration, render props API, or encountering positioning, popup, v1.0 rc / pre-GA issues.
bun-nextjs
This skill should be used when the user asks about "Next.js with Bun", "Bun and Next", "running Next.js on Bun", "Next.js development with Bun", "create-next-app with Bun", or building Next.js applications using Bun as the runtime.
bun-react-ssr
Use when building server-rendered React with Bun, including streaming SSR, hydration, renderToString, or custom SSR without a framework.