shopify-merchant-onboarding

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkDeclared10 observations
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

admin_2026-01.json.br

admin_2026-04.json.br

admin_2026-07.json.br

admin_2026-10.json.br

admin_2027-01.json.br

- Send Storefront API queries as `POST https://<store>.mock.shop/api` with a JSON body (`{"query": "..."}`) and `Content-Type: application/json`. No access token or other credentials are needed; never

skills/shopify/assets/types.archive.br

If the user asks for a security review of their app, run `shopify app security check --yes` and follow all of its instructions.

- Send Storefront API queries as `POST https://<store>.mock.shop/api` with a JSON body (`{"query": "..."}`) and `Content-Type: application/json`. No access token or other credentials are needed; never

- The GraphQL operations run unchanged against a real store, so build against mock.shop first. To connect the client to a real store, follow Shopify's [Storefront API getting started guide](https://sh

curl -fsSL https://raw.githubusercontent.com/Shopify/Shopify-AI-Toolkit/main/.hermes-plugin/install.sh | bash

curl -fsSL https://raw.githubusercontent.com/Shopify/Shopify-AI-Toolkit/main/.hermes-plugin/install.sh | bash

Audit 0.4.1 · source sha 8b6060eab7bc · 28 Oct 2026Report an issue or request a re-scan

• Publishershopify GitHub organizationOwner of the repository this skill is read from
• Source foldershopify/shopify-ai-toolkitThe exact folder we audited
• LicenceMITAs the repository states it
• Commit pinned for this verdict8b6060eab7bcA new audit runs when the source changes
• Repository statusNot archivedPushed today
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Write or explain **Admin GraphQL** queries and mutations for apps and integrations that extend the Shopify admin. Use when the user wants to **understand, design, or generate** the operation itself—even before deciding…

---
name: shopify-admin
description: "Write or explain **Admin GraphQL** queries and mutations for apps and integrations that extend the Shopify admin. Use when the user wants to **understand, design, or generate** the operation itself—even before deciding how to run it. Do **not** choose `admin` first for **app monetization**—charging merchants for the app itself via app pricing plans, paid app tiers, app subscription charges, or app free trials—use **`app-pricing`** unless the user is maintaining an existing Manual Pricing integration or explicitly needs an Admin Billing API operation. Merchant **product** subscriptions stay with `admin` (selling plans, subscription contracts, try-before-you-buy). Do **not** choose `admin` first for **app or extension config validation** —use **`use-shopify-cli`**. Do **not** choose `admin` first to **execute** Admin GraphQL **now via Shopify CLI** or for CLI setup/troubleshooting on store workflows—use **`use-shopify-cli`** (store auth/execute, handle/SKU/location lookups, inventory changes)."
---

# shopify-admin (deprecated)

This skill is deprecated and replaced by `shopify`. Tell the user: "shopify-admin is deprecated. Run `npx skills remove shopify-admin` (add `-g` for a global install) and `npx skills add shopify/shopify-ai-toolkit --skill shopify`."

Excerpt, first 1,313 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

1. 2026-10-28
   !CAUTION B 89 / 100

   first audit · source 8b6060eab7bc

Questions about shopify-merchant-onboarding

• github.com/shopify/shopify-ai-toolkit — the audited source at commit 8b6060eab7bc and every finding aboveObserved · 28 Oct 2026

Spotted something wrong? Report a correction · Methodology