CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

shopify-payments-apps

The Payments Apps API enables payment providers to integrate their payment solutions with Shopify's checkout.

53

Quality

67%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./plugins/shopify/skills/shopify-payments-apps/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

73%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body excels at actionability and workflow clarity: fully executable commands, a numbered search-write-validate sequence, explicit retry semantics, and a hard validation gate before returning code. Its main weakness is redundancy — the mandatory search/validate instructions are stated twice in near-verbatim form and the generic best-practice bullet list pads the token budget. Progressive disclosure is well handled by delegating detail to the search script, with only a minor gap around the unexplained assets file.

Suggestions

Deduplicate: keep the numbered five-step sequence once and have the MANDATORY sections cover only error-recovery details, removing the repeated command invocations and placeholder-flag explanations (~30-40% token savings).

Trim the 'Think about all the steps' bullet list to the few Payments Apps API-specific behaviors Claude would not infer on its own; drop generic items like 'Understand PCI compliance requirements' and 'Implement proper error handling'.

Briefly state what the bundle contains (e.g. that assets/ holds the indexed Payments Apps API docs consumed by search_docs.mjs) so the file layout is self-explanatory.

DimensionReasoningScore

Conciseness

Roughly 40% of the body is repetition: the 'Required Tool Calls' numbered list restates the same search_docs.mjs and validate.mjs commands (including placeholder-flag explanations) that the two MANDATORY sections then repeat nearly verbatim, and the 'Think about all the steps' bullet list (PCI compliance, 3D Secure, error handling) is generic guidance Claude already knows. This matches 'Noticeably verbose; several unnecessary explanations or padded sections'; it is not a 1 because no basic concepts are explained and the commands themselves are tight, and not a 3 because the duplication is substantial rather than a single trimmable passage.

2 / 5

Actionability

Commands are copy-paste ready with concrete placeholder semantics spelled out ('scripts/search_docs.mjs "<operation or component name>" --model YOUR_MODEL_NAME ...', 'generate a stable random ID per code block and reuse it across validation retries'), plus a worked example ("paymentSessionPending mutation") and explicit retry limits. This matches 'Fully executable; copy-paste ready code or commands; specific examples cover the common cases'; there is no missing execution detail that would drop it to 4.

5 / 5

Workflow Clarity

The body gives a numbered five-step sequence (search -> write -> validate -> retry loop -> return only after passing) with an explicit validation checkpoint, a feedback loop for error recovery ('Read the error message carefully... search for the correct values... retry up to 3 times; after 3 failures, return the best attempt with an explanation'), and a hard gate ('Do not return code to the user without completing step 3'). This matches the top anchor 'Clear sequence with explicit validation steps; feedback loops for error recovery; checklists for complex processes'.

5 / 5

Progressive Disclosure

The bundle structure is sound: SKILL.md stays a lean harness while bulk documentation detail is delegated to the on-demand search corpus (assets/payments-apps_2026-04.json.gz) via the bundled scripts/search_docs.mjs and scripts/validate.mjs, both of which exist and are referenced with clear section headers — no nested-reference chains. It is not a 5 because the assets corpus is never mentioned in the body (its role is implicit), and the duplication between the top checklist and the MANDATORY sections blurs what belongs where; not a 3 because no content that belongs in a separate file is inlined and navigation between the sections and scripts is clear.

4 / 5

Total

16

/

20

Passed

Description

45%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is concise and names a specific API, but it reads more like a documentation tagline than a skill trigger. It describes only one generic action and completely lacks a 'when to use this skill' clause, which both caps completeness and weakens trigger quality. Concrete capabilities (writing GraphQL queries/mutations, searching Payments Apps API docs) and use-when triggers would substantially improve it.

Suggestions

Add an explicit trigger clause, e.g. 'Use when writing GraphQL queries or mutations for the Shopify Payments Apps API (payment sessions, refunds, voids, 3D Secure).'

State concrete actions instead of the generic 'integrate their payment solutions' — e.g. 'Generates and validates Payments Apps API GraphQL operations and searches the Payments Apps API documentation for working examples.'

Include natural trigger terms and synonyms users would type (payment sessions, refunds/voids, capture, GraphQL, payment provider app) to improve trigger-term coverage and distinctiveness from generic Shopify checkout skills.

DimensionReasoningScore

Specificity

The description names the domain ("Payments Apps API", "Shopify's checkout") but offers only a single generic action — "integrate their payment solutions" — with no concrete capabilities like generating GraphQL queries/mutations, searching docs, or validating code. This matches the anchor 'Names the domain but actions are minimal or generic'; it is above score 1 because the domain is specific, but below score 3 because 'integrate payment solutions' is not a concrete action.

2 / 5

Completeness

A reasonably clear 'what' is present (enables payment providers to integrate with Shopify's checkout), but there is no 'Use when...' clause or any trigger guidance, which caps completeness at 3 per the judging guidelines. It is not a 2 because the 'what' is clear and domain-specific, not vague; it cannot be a 4 because the 'when' is entirely missing rather than weakly implied.

3 / 5

Trigger Term Quality

It contains relevant domain keywords a user might say ("Payments Apps API", "payment providers", "Shopify's checkout") but misses common natural variations such as GraphQL, payment sessions, refunds, 3D Secure, or payment session mutations. This matches 'Some relevant keywords but missing common variations or synonyms'; it is not a 4 because the natural phrases a developer would actually type when needing this skill are absent.

3 / 5

Distinctiveness Conflict Risk

The named API ("Payments Apps API") carves out a niche, but the phrasing around 'integrate payment solutions with Shopify's checkout' could plausibly overlap with other Shopify checkout/payment-related skills. This matches 'Somewhat specific but could still overlap with similar skills'; not a 4 because no distinct trigger phrases are given to disambiguate, not a 2 because the API name is specific rather than broad.

3 / 5

Total

11

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

openai/plugins

Path

plugins/shopify/skills/shopify-payments-apps/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.