bigcommerce

bigcommerce is a skill for Claude Code, Codex from TerminalSkills/skills. It costs 76 tokens per session (1,494 once invoked), scanned A, original, Apache-2.0.

A guide to building online stores with BigCommerce, a hosted e-commerce platform that provides storefronts and REST and GraphQL APIs. It also covers headless stores, where the shopping interface is separate from the commerce backend.

In plain words
What is it for?
Use it to create or migrate a store, fetch products through the Storefront API, and connect a custom web frontend to BigCommerce.
Why use it?
It helps when you need an online store with a programmable backend or want to move from another commerce platform. It explains how a frontend such as Next.js or Gatsby can use BigCommerce.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one. Also seen: positional $N argument.

Good fit Use it to create or migrate a store, fetch products through the Storefront API, and connect a custom web frontend to BigCommerce.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/terminalskills/skills/bigcommerce
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add TerminalSkills/skills --skill bigcommerce
Clone the repo
git clone --depth 1 https://github.com/TerminalSkills/skills

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for bigcommerce

README.md
[![agentmods](https://agentmods.dev/badge/skills/terminalskills/skills/bigcommerce/github.svg)](https://agentmods.dev/skills/terminalskills/skills/bigcommerce)
Your own site
<a href="https://agentmods.dev/skills/terminalskills/skills/bigcommerce"><img src="https://agentmods.dev/badge/skills/terminalskills/skills/bigcommerce/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for bigcommerce

Your own site · 80×15
<a href="https://agentmods.dev/skills/terminalskills/skills/bigcommerce"><img src="https://agentmods.dev/badge/skills/terminalskills/skills/bigcommerce.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 76 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,494 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 3 findings, up to high

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • high Privilege Escalation · line 106
    Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
    Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
  • medium Data Exfiltration · line 76
    Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
    Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
  • medium MCP Rug Pull · line 105
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00076 $0.01494
Opus 5.5 $0.00030 $0.00598
Sonnet 5.5 $0.00015 $0.00299
Haiku 4.5 $0.00008 $0.00149

Measured 20d ago against content hash 545f5c3b508c, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

bigcommerce scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 20d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/bigcommerce/SKILL.md · 142 lines

How it starts

The opening of the file, as written. The whole thing — 142 lines — stays where its author put it; the contents beside it link to each section on GitHub.

BigCommerce

Overview

BigCommerce is a hosted e-commerce platform with strong headless capabilities. Unlike Shopify, it includes more features out of the box (no app fees for basic needs), has a comprehensive REST + GraphQL API, and supports multi-storefront. Works as a backend for headless commerce with Next.js (BigCommerce's own starter is Catalyst) or any other frontend.

Instructions

Step 1: Storefront API (GraphQL)

The endpoint is https://store-{store_hash}.mybigcommerce.com/graphql for the default channel (or your storefront domain plus /graphql); other channels use store-{store_hash}-{channel_id}.mybigcommerce.com. Create a token in the control panel or with POST /v3/storefront/api-token on the management API. BigCommerce's current docs say server-side integrations created after June 30, 2026 should use private tokens rather than storefront tokens; check the GraphQL authentication page for which applies to you. Limits: query complexity 10,000, depth 16, at most 50 products per page. Try queries in Settings > API > Storefront API Playground first.

// lib/bigcommerce.ts — Fetch products via GraphQL Storefront API
const STOREFRONT_TOKEN = process.env.BC_STOREFRONT_TOKEN!
const STORE_HASH = process.env.BC_STORE_HASH!

export async function getProducts(limit = 12) {
  const query = `
    query Products($first: Int!) {
      site {
        products(first: $first) {
          edges {
            node {
              entityId
              name
              path
              prices { price { value currencyCode } }
              defaultImage { url(width: 400) altText }
            }
          }
        }
      }
    }
  `

  const res = await fetch(`https://store-${STORE_HASH}.mybigcommerce.com/graphql`, {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      Authorization: `Bearer ${STOREFRONT_TOKEN}`,
    },
    body: JSON.stringify({ query, variables: { first: limit } }),
  })

  const { data } = await res.json()
  return data.site.products.edges.map(e => e.node)
}

Read the full file on GitHub · 142 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 20d ago Changed · +27 lines · +23 tokens per session 545f5c3b508c
  2. 1mo ago First seen · 115 lines · 53 tokens per session scan A 49d5e1b4fec4

Subscribe to this mod's changes

bigcommerce is a skill published in the GitHub repository TerminalSkills/skills (177 stars, last pushed today), licensed Apache-2.0. It adds 76 tokens to every session and 1,494 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-05.

Related

Other skills, from other repositories

convex-billing

Add Stripe billing/payments to the Convex app via @convex-dev/stripe (checkout + webhook + gating).

openclaw/clawhub · 29 tokens

cloudbase-wechat-integration

A guide for connecting CloudBase applications to WeChat services, including payments, official accounts, and user identity.

TencentCloudBase/CloudBase-AI-Toolkit · 94 tokens

shopify-admin

Write or explain Admin GraphQL queries and mutations for apps and integrations that extend the Shopify admin. Use when the user wants to understand, design, or generate the operation itself—even before deciding how to run it. Do not choose admin first for app monetization—charging merchants for the app itself via app…

Shopify/Shopify-AI-Toolkit · 226 tokens

shopify-functions

Shopify Functions allow developers to customize the backend logic that powers parts of Shopify. Available APIs: Discount, Cart and Checkout Validation, Cart Transform, Pickup Point Delivery Option Generator, Delivery Customization, Fulfillment Constraints, Local Pickup Delivery Option Generator, Order Routing Location…

Shopify/Shopify-AI-Toolkit · 61 tokens

gplay-purchase-verification

Server-side purchase verification for in-app products and subscriptions using Google Play Developer API. Use when implementing receipt validation in your backend.

hanamizuki/solopreneur · 32 tokens

baselinker-webhooks

Receive BaseLinker (Base.com) webhooks. Use when building a BaseLinker order or warehouse callback receiver, because BaseLinker is not a normal webhook source: deliveries arrive as HTTP HEAD requests with NO body, the entire payload is in the query string (observed params: orderid, state), there is NO signature…

hookdeck/webhook-skills · 131 tokens