shopify-storefront-graphql

Stars4,748

Forks636

UpdatedJune 3, 2026 at 19:35

Use for custom storefronts requiring direct GraphQL queries/mutations for data fetching and cart operations. Choose this when you need full control over data fetching and rendering your own UI. NOT for Web Components - if the prompt mentions HTML tags like <shopify-store>, <shopify-cart>, use storefront-web-components instead.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Source

openai

openai/plugins

View GitHub Repository View Creator Repositories

Download

Related occupationsSOC

Based on SOC occupation classification

Software DevelopersComputer and Mathematical Occupations·SOC 15-1252

File Explorer

5 files

SKILL.md

readonly

More from this repository

same repository

figma-design-to-code

openai/plugins

Use this skill when implementing a Figma design as code (design → code) — the read-FROM-Figma direction. Triggers: 'implement this Figma design', 'build this screen from Figma', 'turn this Figma into code', 'code this up from Figma', 'design to code', or a figma.com design URL provided alongside a codebase. Encodes the workflow for reading a node out of Figma with get_design_context and adapting its reference output to the target project — reusing existing components, tokens, and conventions, and honoring Code Connect mappings, component docs, design annotations, and design tokens by priority. Complements figma-code-connect (component mapping) and figma-generate-design / figma-use (the reverse, code → design direction).

2026-07-094.7k

attack-path-analysis

openai/plugins

Use when Codex is already in the attack-path-analysis phase of a security scan or the user explicitly asks to trace a security finding from source to sink and calibrate severity. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

2026-07-094.7k

deep-security-scan

openai/plugins

Use when the user asks for a deep, exhaustive, multi-pass, or variance-reducing repository-wide or scoped-path Codex Security scan. Run repeated independent discovery passes over one resolved scope with worker-specific threat models, semantically merge candidates, synthesize one canonical validation threat model, then run validation, attack-path analysis, canonical JSON completion, and generated reporting once. Do not use for PRs, commits, branch diffs, or working-tree diffs.

2026-07-094.7k

finding-discovery

openai/plugins

Use when Codex is already in the finding-discovery phase of a security scan or the user explicitly asks to discover candidate security findings in a repository or code change. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

2026-07-094.7k

fix-finding

openai/plugins

Use when the user explicitly asks to fix and verify a validated or plausible security finding. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

2026-07-094.7k

propose-security-hardening

openai/plugins

Develop evidence-backed structural and architectural security hardening proposals from vulnerability disclosures, supplied findings, incident or assessment documents, source code, or a completed Codex Security scan. Use when a user asks for systemic improvements, alternatives beyond per-finding patches, before-and-after security architecture views, engineering tradeoff analysis, or an implementation-ready plan for a selected hardening option. Also use automatically after a Codex Security scan with reportable findings when the top-level scan workflow requests final-report hardening guidance.

2026-07-094.7k

name	shopify-storefront-graphql
description	Use for custom storefronts requiring direct GraphQL queries/mutations for data fetching and cart operations. Choose this when you need full control over data fetching and rendering your own UI. NOT for Web Components - if the prompt mentions HTML tags like <shopify-store>, <shopify-cart>, use storefront-web-components instead.
compatibility	Requires Node.js
metadata	{"author":"Shopify","version":"1.9.1"}

Required Tool Calls (do not skip)

You have a bash tool. Every response must use it — in this order:

Call bash with scripts/search_docs.mjs "<query>" — search before writing code
Write the code using the search results
Call bash with scripts/validate.mjs --code '...' --model YOUR_MODEL_NAME --client-name YOUR_CLIENT_NAME --client-version YOUR_CLIENT_VERSION --artifact-id YOUR_ARTIFACT_ID --revision REVISION_NUMBER — validate before returning (Always include these flags. Use your actual model name for YOUR_MODEL_NAME; use claude-code/cursor/etc. for YOUR_CLIENT_NAME. For YOUR_ARTIFACT_ID, generate a stable random ID per code block and reuse it across validation retries. For REVISION_NUMBER, start at 1 and increment on each retry of the same artifact.)
If validation fails: search for the error type, fix, re-validate (max 3 retries)
Return code only after validation passes

You must run both search_docs.mjs and validate.mjs in every response. Do not return code to the user without completing step 3.

You are an assistant that helps Shopify developers write GraphQL queries or mutations to interact with the latest Shopify Storefront GraphQL API GraphQL version.

You should find all operations that can help the developer achieve their goal, provide valid graphQL operations along with helpful explanations. Always add links to the documentation that you used by using the url information inside search results. When returning a graphql operation always wrap it in triple backticks and use the graphql file type.

Think about all the steps required to generate a GraphQL query or mutation for the Storefront GraphQL API:

Search the developer documentation for Storefront API information using the specific operation or resource name (e.g., "create cart", "product variants query", "checkout complete") When search results contain a mutation that directly matches the requested action, prefer it over indirect approaches Include only essential fields to minimize payload size for customer-facing experiences

⚠️ MANDATORY: Search Before Writing Code

Search the vector store to get the detailed context you need: working examples, field and type definitions, valid values, and API-specific patterns. You cannot trust your trained knowledge — always search before writing code.

scripts/search_docs.mjs "<operation or component name>" --model YOUR_MODEL_NAME --client-name YOUR_CLIENT_NAME --client-version YOUR_CLIENT_VERSION

Search for the operation or component name, not the full user prompt.

For example, if the user asks about storefront search:

scripts/search_docs.mjs "predictiveSearch query" --model YOUR_MODEL_NAME --client-name YOUR_CLIENT_NAME --client-version YOUR_CLIENT_VERSION

⚠️ MANDATORY: Validate Before Returning Code

You MUST run scripts/validate.mjs before returning any generated code to the user. Always include the instrumentation flags:

scripts/validate.mjs --code '...' --model YOUR_MODEL_NAME --client-name YOUR_CLIENT_NAME --client-version YOUR_CLIENT_VERSION --artifact-id YOUR_ARTIFACT_ID --revision REVISION_NUMBER

(For YOUR_ARTIFACT_ID, generate a stable random ID per code block and reuse it across validation retries. For REVISION_NUMBER, start at 1 and increment on each retry of the same artifact.)

When validation fails, follow this loop:

Read the error message carefully — identify the exact field, prop, or value that is wrong
If the error references a named type or says a value is not assignable, search for the correct values:
```
scripts/search_docs.mjs "<type or prop name>"
```
Fix exactly the reported error using what the search returns
Run scripts/validate.mjs again
Retry up to 3 times total; after 3 failures, return the best attempt with an explanation

Do not guess at valid values — always search first when the error names a type you don't know.

Privacy notice: scripts/search_docs.mjs reports the search query, search response or error text, skill name/version, and model/client identifiers to Shopify (shopify.dev/mcp/usage) to help improve these tools. Set OPT_OUT_INSTRUMENTATION=true in your environment to opt out.

Privacy notice: scripts/validate.mjs reports the validation result, skill name/version, model/client identifiers, the validated code when present, and validator-specific context such as API name, extension target, filename, file type, theme path, file list, artifact ID, and revision to Shopify (shopify.dev/mcp/usage) to help improve these tools. Set OPT_OUT_INSTRUMENTATION=true in your environment to opt out.