Agent skill · software engineering · jeremylongshore
shopify-policy-guardrails
Implement Shopify app policy enforcement with ESLint rules for API key
Why this skill is useful
Adds custom ESLint rules and pre-commit hooks for enforcing Shopify app policies that the AI wouldn't generate on its own.
What it needs
Requires eslint, git installed locally. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Shopify Policy & Guardrails Overview Automated policy enforcement for Shopify apps: secret detection, query cost budgets, App Store compliance checks, and CI policy validation. Prerequisites ESLint configured in project Pre-commit hooks infrastructure CI/CD pipeline with GitHub Actions Shopify app with shopify.app.toml Instructions Step 1: Secret Detection Rules Custom ESLint rule that catches hardcoded Shopify tokens (shpat, shpss) and API secrets in string literals and template literals. See Secret Detection ESLint for the complete rule implementation. Step 2: Query Cost Budget Enforcement Static analysis of GraphQL queries enforcing budgets: max 100 items per first: param, max 3 levels of nesting, and max 500 estimated cost. Runs at build/test time. See Query Cost Budget for the complete implementation. Step 3: Pre-Commit Hooks Git hooks that scan staged changes for Shopify tokens and block .env files from being committed. Step 4: App Store Compliance Checker Pre-submission script that validates all three GDPR webhooks, token hygiene, CSP headers, and API version stability. See Compliance Checker for the complete implementation. Step 5: CI Policy Pipeline GitHub Actions workflow enforcing token scanning, GDPR webhook configuration, and API version stability on every push and PR. See CI Policy Pipeline for the complete workflow. Output ESLint rules catching hardcoded tokens Query cost budgets enforced Pre-commit hooks blocking secret leaks App Store compliance checker CI policy pipeline preventing violations Error Handling Issue Cause Solution ------- ------- ---------- False positive on token Base64 string matched Narrow regex pattern Query cost estimate wrong Complex variable nesting Use actual debug header in tests Pre-commit bypassed --no-verify flag Enforce in CI as backup App Store rejection Missing GDPR webhook Run compliance checker before submit Examples Quick Policy Scan Resources Shopify App Store Requirements ESLint Plugin Development git-secrets
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/shopify-policy-guardrails