shopify-expert

An agent skill by Jeffallan, from Jeffallan/claude-skills. Tags: api, automation, javascript, performance, web.

What it does

Builds and debugs Shopify themes (.liquid files, theme.json, sections), develops custom Shopify apps (shopify.app.toml, OAuth, webhooks), and implements Storefront API integrations for headless storefronts. Use when building or customizing Shopify themes, creating Hydrogen or custom React storefronts, developing Shopify apps, implementing checkout UI extensions or Shopify Functions, optimizing performance, or integrating third-party services. Invoke for Liquid templating, Storefront API, app development, checkout customization, Shopify Plus features, App Bridge, Polaris, or Shopify CLI workflows.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add Jeffallan/claude-skills --skill shopify-expert

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/Jeffallan/claude-skills
cp -r claude-skills/skills/shopify-expert ~/.claude/skills/shopify-expert

Safety box score

Grade C, moderate risk: 44 of 100 risk points, rated 2026-10-18. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a Shopify development playbook: it scaffolds, edits, tests, and deploys themes, apps, checkout extensions, and Storefront API integrations. The main risks are production-impacting changes to storefronts and checkout/payment flows, plus networked workflows that use tunnels, third-party scripts, and Shopify/merchant credentials.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It directs the agent to run shell commands and install tooling such as `shopify theme check`, `shopify app dev`, and `npm install -g @lhci/cli`.
Network access	2 (moderate)	It uses tunnels and remote services, e.g. `shopify app dev --tunnel-url="https://your-ngrok-url.ngrok.io"`, Storefront API calls, and third-party scripts like `https://www.googletagmanager.com/gtag/js`.
Filesystem reach	1 (low)	It mainly edits scoped project files and configs like `shopify.app.toml`, `templates/product.json`, and theme assets; no off-project deletion or dotfile/system-path access is shown.
Secrets & credentials	2 (moderate)	It handles app secrets and tokens in examples such as `process.env.SHOPIFY_API_KEY!`, `process.env.SHOPIFY_API_SECRET!`, and `X-Shopify-Storefront-Access-Token`.
Privilege & persistence	1 (low)	The only elevated-ish action shown is a global install, `npm install -g @lhci/cli`; there is no sudo, service registration, or OS-level reconfiguration.
Instruction hijack surface	0 (none)	No prompt-injection content, hidden instructions, or requests to ignore higher-priority rules were found in the skill files.
Irreversible actions	3 (high)	It explicitly includes live deployment and buyer-impacting flows: `shopify theme push`, `shopify app deploy`, and post-purchase/checkout extensions that can change orders and payments.
Transparency	0 (none)	All shipped files are readable Markdown and code blocks; there are no binaries, minified blobs, or decoded-at-runtime payloads.

Before installing

Check the deployment commands in `SKILL.md`; confirm you’re okay with an agent using `shopify theme push` and `shopify app deploy` against real stores.
Review `references/checkout-customization.md` for post-purchase and checkout extension behavior; test in a sandbox before any live checkout use.
Inspect `references/app-development.md` for required scopes and credential handling; ensure app secrets stay in env vars and not in theme code.
Decide whether global tooling is acceptable before install, since `references/performance-optimization.md` recommends `npm install -g @lhci/cli`.

Rated 2026-10-18 by an automated review of 6 files from the skill's repository.

Source

Repository: Jeffallan/claude-skills (all skills from this repository)
Path: skills/shopify-expert/SKILL.md
Branch: main
Updated: 2026-09-19

gh-cli — Enforces authenticated gh CLI workflows over unauthenticated curl, WebFetch, and MCP fetch patterns.
running-release-tests — Run automated release testing (UI or API) via the AWS DevOps Agent using a pre-configured test profile.
csharp-developer — Use when building C# applications with .NET 8+, ASP.NET Core APIs, or Blazor web apps. Builds REST APIs using minimal or controller-based routing.
dotnet-core-expert — Use when building .NET 8 applications with minimal APIs, clean architecture, or cloud-native microservices. Invoke for Entity Framework Core.
fastapi-expert — Use when building high-performance async Python APIs with FastAPI and Pydantic V2.
fullstack-guardian — Builds security-focused full-stack web applications by implementing integrated frontend and backend components with layered security at every level.