Claude Code, Skill
Shopify Hydrogen Skills
Agent skills for building, maintaining, and upgrading Shopify Hydrogen storefronts with Weaverse.
Compatibility: Not stated.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit d119df41e708, unchanged since the check below.
INSTALL_REMOTE_SCRIPT
Why this grade
- INSTALL_REMOTE_SCRIPT Medium
Fetches a script from the network and runs it (a pipe to a shell, or an install hook with a URL).
skills/weaverse-hydrogen/references/09-deployment.md, line 89
curl -L https://fly.io/install.sh | sh
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
If you think this grade is wrong, email [email protected] with the entry link and your evidence. We aim to acknowledge within two working days and decide within seven. If we confirm an error, we aim to correct it within 24 hours of confirming it. These are aims, not guarantees.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Pass
No shell or command execution found, and no extra permission was declared.
Install and update
Serious
install fetches a script from the network.
INSTALL_REMOTE_SCRIPT
skills/weaverse-hydrogen/references/09-deployment.md, line 89
curl -L https://fly.io/install.sh | sh
Network
Concern
can reach a host that is not written as a fixed address. can reach your-store.com. The description does not name that host. can reach builder.weaverse.io. The description does not name that host. can reach api.github.com. The description does not name that host. can reach reviews-api.com. The description does not name that host. can reach studio.weaverse.io. The description does not name that host.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
skills/hydrogen-analytics-tracking/references/architecture.md, line 120
void fetch("/api/track", {
skills/hydrogen-analytics-tracking/references/gtm-meta-implementation.md, line 357
const res = await fetch(url, {
skills/hydrogen-analytics-tracking/references/gtm-meta-implementation.md, line 451
const res = await fetch(url, {
Show more
skills/hydrogen-analytics-tracking/references/oxygen-full-page-cache.md, line 116
# GET, not HEAD: `curl -I` sends HEAD, which fails the method condition and
skills/hydrogen-analytics-tracking/references/oxygen-full-page-cache.md, line 119
curl -s -D - -o /dev/null -H "Accept-Encoding: gzip" https://your-store.com/ \
skills/hydrogen-analytics-tracking/references/oxygen-full-page-cache.md, line 137
curl -sS -o /dev/null -w "ttfb=%{time_starttransfer}s\n" https://your-store.com/
skills/hydrogen-analytics-tracking/references/webhook-forwarding-via-builder.md, line 153
# 1. Customer calls Weaverse API (Studio UI in Phase 2; curl for now)
skills/hydrogen-analytics-tracking/references/webhook-forwarding-via-builder.md, line 154
curl -X POST https://builder.weaverse.io/api/webhook-forwards \
skills/setup-weaverse-project/SKILL.md, line 127
curl -sf -o /dev/null -w "%{http_code}" http://localhost:3456 # expect 200
skills/setup-weaverse-project/SKILL.md, line 168
curl -sf -o /dev/null -w "%{http_code}" http://localhost:3456 # expect 200
skills/setup-weaverse-project/SKILL.md, line 264
curl -sf -o /dev/null -w "%{http_code}" http://localhost:3456 # 200
skills/shopify-hydrogen/scripts/get_weaverse_page.mjs, line 32
const response = await fetch("https://weaverse.io/docs/mcp", {
skills/shopify-hydrogen/scripts/search_shopify_docs.mjs, line 13
const response = await fetch("https://shopify.dev/assistant/search", {
skills/shopify-hydrogen/scripts/search_weaverse_docs.mjs, line 13
const response = await fetch("https://weaverse.io/docs/mcp", {
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
skills/hydrogen-cookbooks/references/weaverse-hydrogen-integration.md, line 93
└── 📄 .env # Environment variables
skills/setup-weaverse-project/SKILL.md, line 164
grep -E "^(PUBLIC_STORE_DOMAIN|PUBLIC_STOREFRONT_API_TOKEN)=" .env
skills/weaverse-content-api/scripts/weaverse_content_api.mjs, line 29
const KEY = process.env.WEAVERSE_API_KEY;
Show more
skills/weaverse-hydrogen/SKILL.md, line 74
.env
skills/weaverse-hydrogen/references/01-project-structure.md, line 32
└── .env # Environment variables
skills/figma-to-weaverse/SKILL.md, line 39
2. **Right storefront.** `PUBLIC_STOREFRONT_ID` in `.env` must match the storefront in `.shopify/project.json`. A mismatched `.env` renders another brand's sales channel locally, a
skills/figma-to-weaverse/SKILL.md, line 124
- **Debugging data with the wrong storefront in `.env`** - "collection not found" may just mean the local token belongs to another brand's channel. Check preflight item 2 before bl
skills/hydrogen-cookbooks/references/weaverse-hydrogen-integration.md, line 790
#### File: /.env
skills/hydrogen-upgrades/references/upgrade-2025.7.0-to-2026.1.0.md, line 203
3. The `.env` and data layer are not affected by this upgrade
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Note
no licence file found.
LICENCE_MISSING
No file path was stored.
no licence file found.
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit d119df41e708. install fetches a script from the network. can reach a host that is not written as a fixed address. can reach your-store.com. The description does not name that host. can reach builder.weaverse.io. The description does not name that host. can reach api.github.com. The description does not name that host. can reach reviews-api.com. The description does not name that host. can reach studio.weaverse.io. The description does not name that host. reads a credential or environment file. no licence file found.
Date and source
Date checked:
github.com
Commit graded: d119df41e708c2079c1a0533760d9efc66f19b55
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.