CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

shopify-customer

The Customer Account API allows customers to access their own data including orders, payment methods, and addresses.

52

Quality

65%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./plugins/shopify/skills/shopify-customer/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

60%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body delivers a genuinely strong workflow: mandatory search before coding, mandatory validation before returning, and an explicit error-recovery retry loop — exactly the pattern the rubric rewards. Its weaknesses are redundancy (the tool-call protocol and privacy notices are each duplicated nearly verbatim) and the absence of any example GraphQL operation. Bundle references to the two scripts are real and well-signaled, though the assets file is orphaned.

Suggestions

Deduplicate: collapse the 'Required Tool Calls' list and the two MANDATORY sections into one authoritative workflow, and merge the two near-identical privacy notices into a single note covering both scripts.

Add one short example GraphQL query for the Customer Account API so the skill shows the expected output format (triple-backtick graphql block with a doc link), rather than only describing it.

Document or remove `assets/customer_2026-04.json.gz` — it is present in the bundle but never referenced in the body, leaving its purpose and any related tooling undiscoverable.

DimensionReasoningScore

Conciseness

The same instructions are stated twice: the opening 'Required Tool Calls' list and the later 'MANDATORY' sections repeat the search and validate commands, including the identical parenthetical about YOUR_ARTIFACT_ID and REVISION_NUMBER (lines 17 and 67), and two near-duplicate privacy notices (lines 83 and 87). Lines 34-42 also pad with generic advice Claude already knows ('Consider privacy and data protection requirements', 'validate required fields'). This matches anchor 2 (noticeably verbose, several unnecessary or padded sections) — worse than anchor 3's 'some unnecessary explanation', better than anchor 1 since nothing is a from-scratch concept tutorial.

2 / 5

Actionability

Commands are concrete and executable: exact invocations of `scripts/search_docs.mjs "<query>"` and `scripts/validate.mjs` with every flag spelled out, placeholders explained, a worked search example ('customer orders query'), and an explicit 3-retry error loop. The gap keeping it from anchor 5: no example GraphQL query or mutation anywhere, and placeholders like YOUR_MODEL_NAME must be filled in by the reader. Anchor 4 (mostly executable, concrete commands with minor gaps) is the best fit.

4 / 5

Workflow Clarity

The sequence is explicit and well-ordered (search → write code → validate → on failure search the error type, fix, re-validate, max 3 retries → return only after passing), with a mandatory validation checkpoint and a feedback loop, matching the anchor-5 pattern. It drops to anchor 4 because the workflow is presented twice in competing forms (the top 'Required Tool Calls' list vs. the MANDATORY sections) with slightly different framing, and the retry budget is stated inconsistently ('max 3 retries' as retries vs. 'Retry up to 3 times total'), which a careful reader must reconcile.

4 / 5

Progressive Disclosure

The body is organized into clear sections and the two referenced bundle files (`scripts/search_docs.mjs`, `scripts/validate.mjs`) both exist and are one level deep — verified against the actual bundle. This fits anchor 4 (good structure, references mostly clear, minor gaps). It is short of anchor 5 because `assets/customer_2026-04.json.gz` sits in the bundle unmentioned and undocumented, so navigation of the bundle is incomplete; it is well above anchor 3 since nothing that belongs in a separate file is inlined.

4 / 5

Total

14

/

20

Passed

Description

53%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is accurate and domain-specific but reads as an API summary rather than a skill description: it says nothing about what the skill does (generating GraphQL queries/mutations) or when to use it. It is clearly above the vague 'bad' examples but well short of the 'good' examples, which all pair concrete actions with an explicit 'Use when' clause.

Suggestions

Add an explicit trigger clause, e.g. 'Use when writing GraphQL queries or mutations against the Shopify Customer Account API or when the user asks about customer orders, addresses, or payment methods.'

State the skill's actual action, not just the API's capability — e.g. 'Generates validated GraphQL queries and mutations for...' — so the 'what' describes what the skill does.

Include high-traffic natural terms users would say: 'Shopify', 'GraphQL', 'customer orders', 'account', 'profile', to improve trigger matching and distinctiveness from other Shopify API skills.

DimensionReasoningScore

Specificity

It names the domain ("Customer Account API") and concrete data objects ("orders, payment methods, and addresses"), but the only action named is the generic "allows customers to access their own data" — it never states what the skill itself does (write GraphQL queries/mutations). This matches anchor 3 (names domain and 1-2 concrete actions, not comprehensive); it is above anchor 2 because the data types are specific, and below anchor 4 because no skill-level actions are listed.

3 / 5

Completeness

The "what" is stated clearly (access to orders, payment methods, addresses), but there is no "Use when..." clause or any equivalent trigger guidance — the description never says when Claude should invoke this skill. Per the judging guideline, a missing 'Use when' clause caps completeness at 3, which this matches exactly (clear 'what', 'when' missing).

3 / 5

Trigger Term Quality

Relevant keywords exist ("Customer Account API", "customers", "orders", "payment methods", "addresses"), but common natural variations are missing: no "Shopify", "GraphQL", "query", "account management", or "profile". This fits anchor 3 (some relevant keywords but missing common variations or synonyms); it lacks the broader coverage of anchor 4 and is well above anchor 2's single generic keyword.

3 / 5

Distinctiveness Conflict Risk

"Customer Account API" is a specific, well-scoped API surface, so the niche is mostly distinct, but it omits "Shopify" and "GraphQL", creating minor overlap risk with other Shopify/API skills (e.g., Admin API skills). This sits between anchor 3 (could still overlap with similar skills) and anchor 5 (clear niche with minimal conflict), matching anchor 4 (mostly distinct, minor overlap risk with closely related skills).

4 / 5

Total

13

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

openai/plugins

Path

plugins/shopify/skills/shopify-customer/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.