
from hermes-one-click139
Run Shopify Admin & Storefront GraphQL queries and mutations via curl for products, orders, customers, inventory, and metafields.
Provides curl-based recipes and guidance to interact with Shopify's Admin and Storefront GraphQL APIs. Covers listing and searching products, managing inventory, reading and creating orders, working with customers, metafields, bulk operations, webhooks, and handling GraphQL-specific pitfalls (GID IDs, rate limits, errors). Includes ready-to-run shop_gql helper and examples for common queries and mutations.
Use when you need a lightweight, scriptable way to query or mutate Shopify stores from a CLI or automation environment without SDKs. Good for quick fixes, data exports, inventory adjustments, and small integrations where embedding a full SDK is unnecessary. Not for building public apps — follow Shopify's app platform guidance for production production integrations.
Best with agents that can run shell commands and manage environment variables (CLI-capable agents).
A well-written Shopify GraphQL skill providing curl-based access to Admin and Storefront APIs. SKILL.md is comprehensive with clear prerequisites, environment variable setup, and extensive examples covering products, orders, customers, inventory, metafields, and webhooks. No bundled scripts — all instructions are shell commands meant to be run ad-hoc. The skill correctly uses environment variables for credentials and includes a helpful safety section warning about destructive mutations.
Security deductions: shell injection risk from unquoted variable interpolation in curl commands (-12). The skill references environment variables in shell snippets which are interpolated into curl commands, but these are user-controlled env vars (not attacker input), so risk is low. No hardcoded credentials, no destructive commands without guards, no telemetry, no curl-pipe-bash. The skill is purely instructional with no executable scripts. Architecture is decent — good frontmatter, clear sections, progressive disclosure — but no scripts/ or references/ directories, making it a flat single-file skill. Usefulness is moderate: Shopify GraphQL is niche but well-served by this skill for developers who don't want an SDK dependency.