Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add mrmarufpro/shopify-embedded-app-verify/plugin install shopify-embedded-app-verifyWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mrmarufpro/shopify-embedded-app-verify/setup-embedded-app-verify)<a href="https://agentmods.dev/skills/mrmarufpro/shopify-embedded-app-verify/setup-embedded-app-verify"><img src="https://agentmods.dev/badge/skills/mrmarufpro/shopify-embedded-app-verify/setup-embedded-app-verify.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00050 | $0.01576 |
| Opus 5 | $0.00025 | $0.00788 |
| Sonnet 5 | $0.00010 | $0.00315 |
| Haiku 4.5 | $0.00005 | $0.00158 |
Grade A, and why
setup-embedded-app-verify scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl-probe it yourself). The verify loop needs it running, but setup How it starts
The opening of the file, as written. The whole thing — 157 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Set up the embedded-app verify loop
Goal: a CDP-enabled, Shopify-authenticated browser plus a project config file.
1. Show the resolved developer config
The plugin config is substituted into this skill at load time:
- browser:
${user_config.browser} - mode:
${user_config.mode} - cdp_port:
${user_config.cdp_port}
A blank value (or a literal dollar-brace placeholder) means the default
applies: chrome / profile / 9222. Tell the user the resolved values and that
they can be changed anytime via /plugin → shopify-embedded-app-verify →
configure (changes reach skills after /reload-plugins or a session restart).
Do NOT read CLAUDE_PLUGIN_OPTION_* env vars — they are only set for plugin
subprocesses such as hooks, never for Bash commands you run.
2. Ensure the browser
Run:
node ${CLAUDE_PLUGIN_ROOT}/scripts/ensure-browser.mjs --browser "${user_config.browser}" --mode "${user_config.mode}" --port "${user_config.cdp_port}" --url "https://admin.shopify.com"
Note the BROWSER_STATE: line in the output — launched-at-url,
launched, or reused — step 3 branches on it.
- Exit 0 → continue.
CDP_BLOCKED_DEFAULT_PROFILE→ explain: this browser refuses CDP on its default profile (Chrome/Edge 136+). The user must switch the plugin's mode option to "profile" (dedicated automation profile, one-time login). Stop.BROWSER_MISMATCH→ the CDP port is already served by a browser that is not the configured one (and not one this plugin launched). Show the message verbatim — the user must quit that browser or change the plugin's browser/cdp_port option. Stop. (A stale automation browser from an earlier run is handled automatically — the script quits it and relaunches.)- Other non-zero → show the message verbatim; stop.
3. Open the verify window and check Shopify authentication
Never open tabs in the developer's own windows.
Preflight said BROWSER_STATE: launched-at-url (profile mode): the
browser opened directly at https://admin.shopify.com — its only tab IS
the verify window. browser_tabs (action: list), select that tab, grab
its targetId with browser_run_code_unsafe, and continue to the auth
check below:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 157 lines · 50 tokens per session scan A 0d189754f4e9
setup-embedded-app-verify is a skill published in the GitHub repository mrmarufpro/shopify-embedded-app-verify (4 stars, last pushed 1mo ago), licensed MIT. It adds 50 tokens to every session and 1,576 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
amazon-bestseller-listing
Amazon Best Sellers listing scraper: extract product cards from any Amazon Best Sellers (zgbs) or /gp/bestsellers/ category page — returns rank (position on chart), asin, title, url, image, imageAlt, price, stars, reviewCount, ratingRaw per item, plus category metadata (categoryName, categoryFullName, categoryUrl) and…
amazon-search-listing
Amazon search and category listing scraper: extract product listings from any Amazon search results page, keyword search URL, or category browse page and return per-item cards (asin, title, url, image, price, listPrice, stars, reviewCount, badges, isAmazonChoice, isBestSeller, isSponsored, delivery, boughtInPast…
etsy-product-detail
Etsy product detail scraper: given an Etsy listing URL, returns full product detail including listingId, title, priceCurrent, priceOriginal, currency, images (all), description, shopName, shopUrl, rating, reviewCount, favorites, inCartCount, variations (with per-option price ranges), highlights, listedDate…
walmart-product-detail
Walmart product detail page extractor: given a walmart.com product URL (walmart.com/ip/...), extract full product data including itemId, title, brand, model, UPC, price, wasPrice, currency, availability, category path, seller info, all images, shortDescription, longDescription, product highlights, full specifications…
walmart-category-listing
Walmart category page scraper: input a walmart.com browse or category URL with optional page number, extract paginated product listings with itemId, url, title, brand, image, price, wasPrice, rating, reviewCount, availability, seller info, fulfillmentBadge, and classType. Use when user mentions walmart category…
broken-link-checker
Scans a website to find broken links (404s, 500s). Crawls internal pages, identifies broken outbound links, and reports source pages for easy fixing. Use this when the user asks to "check for broken links", "find 404s", "audit my links", or "is my site healthy".