Vercel Shop is a monorepo, meaning one code repository that contains multiple related applications and tools, for a Next.js Shopify storefront template, its documentation site, and a scaffolding CLI. It helps developers create and work with Shopify storefronts built on Next.js. The catalogue entries are skills, commands, a plugin, and an instruction for working with this project.
Borrowing it
Nothing to install: this file belongs to vercel/shop. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/vercel/shop/main/.agents/skills/update-shop/SKILL.mdgit clone --depth 1 https://github.com/vercel/shopWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vercel/shop/update-shop)<a href="https://agentmods.dev/skills/vercel/shop/update-shop"><img src="https://agentmods.dev/badge/skills/vercel/shop/update-shop/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/vercel/shop/update-shop"><img src="https://agentmods.dev/badge/skills/vercel/shop/update-shop.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00045 | $0.01916 |
| Opus 5.5 | $0.00018 | $0.00766 |
| Sonnet 5.5 | $0.00009 | $0.00383 |
| Haiku 4.5 | $0.00005 | $0.00192 |
Grade A, and why
update-shop scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
If `gh` cannot read the public repository, read the same `https://api.github.com/repos/vercel/shop/...` endpoints with `curl`. If the comparison lists 300 files, its limit, or the API is unreachable, clone outside the pr How it starts
The opening of the file, as written. The whole thing — 100 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Update Vercel Shop
Upgrade the working storefront from the vercel/shop release it is based on to a newer release, one release at a time. Release notes say what changed and when it applies; the template is a reference, not a replacement for downstream code. Base each decision on implemented behavior, not scaffold age.
Pick a mode
Infer the mode from the user's request:
- Audit — read-only comparison; report relevant differences and stop.
- Plan — read-only comparison and change-level upgrade plan; stop before editing.
- Apply — plan, confirm the selected changes, apply them, and validate. Use when the user asks to update or upgrade the shop.
Inspect the project
Read applicable AGENTS.md instructions, project structure, dependency versions, scripts, configuration, and relevant source. Inspect git status and staged/unstaged diffs, including untracked files, before proposing edits. Identify the storefront root; the upstream repository root maps to that root, which is not necessarily the downstream repository root.
Preserve dirty state, merchant design, custom features, integrations, and intentional departures from the template. Never overwrite custom code with template files or reset, stash, commit, or push without explicit permission. Stop if selected work cannot be separated safely from existing edits.
Keep each change within its owner:
- Shopify owns commerce: catalog, cart state and mutations, checkout, customer accounts, predictive search, policies, and analytics through Hydrogen. Prices, currency, availability, and customer identity come from Shopify.
- Next.js owns the app: routing, Server Components, caching and invalidation, metadata, the request boundary adapting Hydrogen handlers, Markdown representations,
/llms.txt, structured data, sitemap, and crawl guidance. - Eve owns the agent: sessions, channels, tools, connections, and
/eve/v1/*. Eve tools call Shopify directly; Next.js only prepares the browser.
Inline English copy and shopConfig.localization are template defaults, not a migration mandate. Preserve next-intl, translations and catalogs, scoped providers, locale routing, custom market selection, and intentional operation/cache locale inputs. Do not label localization obsolete drift. Any requested simplification must separately assess copy, formatting, commerce country/language, public URLs, and migration parity; currency remains Shopify-owned. Add any copy an item introduces to every catalog.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago Changed · +29 lines · +1 tokens per session ba4998101ec1
- 1mo ago Changed · -1 lines 18ad00fca312
- 1mo ago Changed · -37 lines a42bdd085096
- 1mo ago First seen · 109 lines · 44 tokens per session scan A 8ab99a07b135
update-shop is a skill published in the GitHub repository vercel/shop (126 stars, last pushed 5d ago), licensed MIT. It adds 45 tokens to every session and 1,916 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-26.
update-shop compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| update-shopvercel/shop | Skill | 126 | 5d ago | MIT | A | 45 | Claude Code, Codex |
| amazon-reviews-api-skillbrowser-act/skills | Skill | 6.3k | 2d ago | MIT | A | 124 | Claude Code, Codex |
| amazon-competitor-analyzerbrowser-act/skills | Skill | 6.3k | 2d ago | MIT | A | 48 | Claude Code, Codex |
| asc-subscription-localizationrorkai/app-store-connect-cli-skills | Skill | 1.1k | yesterday | MIT | A | 60 | Claude Code |
| food-orderBitterbot-AI/bitterbot-desktop | Skill | 2.5k | yesterday | MIT | A | 53 | Claude Code, Codex |
| external-purchasesrshankras/claude-code-apple-skills | Skill | 864 | 2d ago | MIT | A | 76 | Claude Code |
| Product Photoshoot Workflowjau123/MeiGen-AI-Design-MCP | Skill | 1.8k | yesterday | MIT | A | 111 | Claude Code |