Vercel Shop is a monorepo, meaning one code repository that contains multiple related applications and tools, for a Next.js Shopify storefront template, its documentation site, and a scaffolding CLI. It helps developers create and work with Shopify storefronts built on Next.js. The catalogue entries are skills, commands, a plugin, and an instruction for working with this project.
Borrowing it
Nothing to install: this file belongs to vercel/shop. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/vercel/shop/main/.agents/skills/shopify-graphql-reference/SKILL.mdgit clone --depth 1 https://github.com/vercel/shopWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vercel/shop/shopify-graphql-reference)<a href="https://agentmods.dev/skills/vercel/shop/shopify-graphql-reference"><img src="https://agentmods.dev/badge/skills/vercel/shop/shopify-graphql-reference/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/vercel/shop/shopify-graphql-reference"><img src="https://agentmods.dev/badge/skills/vercel/shop/shopify-graphql-reference.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00068 | $0.00797 |
| Opus 5.5 | $0.00027 | $0.00319 |
| Sonnet 5.5 | $0.00014 | $0.00159 |
| Haiku 4.5 | $0.00007 | $0.00080 |
Grade A, and why
shopify-graphql-reference scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 43 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Integrate Shopify GraphQL
Treat Shopify AI Toolkit as authoritative for Shopify documentation, schemas, fields, arguments, enum values, API versions, operation design, and validation. This skill owns only the Vercel Shop integration layer.
Read references/REFERENCE.md before editing.
Delegate Shopify facts first
- Choose the Shopify API:
- Use Shopify AI Toolkit's Storefront GraphQL skill for catalog, search, menus, cart, and public metaobject reads.
- Use its Customer skill for profiles, orders, addresses, and other authenticated customer data.
- Use its custom-data skill first for metafields or metaobjects.
- Search current Shopify documentation and validate the complete operation with that skill.
- Do not copy schema snapshots, field catalogs, or generated API reference into this skill.
- If Shopify AI Toolkit is unavailable, use official Shopify documentation and validation tooling; do not guess.
Apply the Vercel Shop conventions
- Inspect the consuming route before choosing cache behavior. Classify the read as static-shell content, request-time shared content, or private/request-scoped data.
- Add the operation to
lib/shopify/operations/<resource>/server.tsin the closest resource domain as an uncachedfetch*function with nonext/cacheimport. Put the cache directive,cacheLife, andcacheTagcalls in aget*wrapper in the consuming domain'slib/<domain>/server.ts(for examplelib/product/server.ts,lib/collections/server.ts,lib/policies/server.ts). Keep pure transforms inlib/shopify/transforms/<resource>/index.ts, named shared contracts in the owning domain'stypes.ts, and reusable fragment documents in their resource domain. Import implementations and types directly; do not add barrels or forwarding exports. - Wrap documents in Hydrogen's
gql()with a leading#graphqlcomment, keep them static, and use variables for dynamic values. Inference supplies types; Shopify AI Toolkit validates fields and arguments. - Reuse the smallest existing fragment that fits by passing it in the
gql(source, [FRAGMENT])list. Extend a shared fragment only when multiple operations need the same selection. - Pass
localetostorefront.requestwhen Shopify localizes the result; never addcountryorlanguagetovariables. - Derive raw Shopify types from fragment documents with
ResultOf<typeof FRAGMENT>underlib/shopify/**; transform catalog/account data into domain types before presentation. Cart types intentionally derive from Hydrogen handlers throughlib/cart/types.ts. - Preserve cache tags and the existing webhook invalidation hierarchy. Do not cache mutations.
- Never place carts in the Next.js data cache; cart reads are memoized per request via
getCart, so cart mutations need no cache invalidation step.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed 52069ddb89ea
- 1mo ago First seen · 43 lines · 68 tokens per session scan A 4db0403b9e14
shopify-graphql-reference is a skill published in the GitHub repository vercel/shop (126 stars, last pushed 5d ago), licensed MIT. It adds 68 tokens to every session and 797 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-26.
shopify-graphql-reference compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| shopify-graphql-referencevercel/shop | Skill | 126 | 5d ago | MIT | A | 68 | Claude Code, Codex |
| convex-billingopenclaw/clawhub | Skill | 9.5k | yesterday | MIT | A | 29 | Claude Code, Codex |
| cloudbase-wechat-integrationTencentCloudBase/CloudBase-AI-Toolkit | Skill | 1.2k | yesterday | MIT | A | 94 | Claude Code |
| shopify-adminShopify/Shopify-AI-Toolkit | Skill | 628 | 10d ago | MIT | A | 226 | Claude Code |
| shopify-functionsShopify/Shopify-AI-Toolkit | Skill | 628 | 10d ago | MIT | A | 61 | Claude Code |
| gplay-purchase-verificationhanamizuki/solopreneur | Skill | 156 | 3d ago | MIT | A | 32 | Claude Code |
| baselinker-webhookshookdeck/webhook-skills | Skill | 98 | yesterday | MIT | A | 131 | Claude Code, Codex |