Home › Rated skills › shopify-alt-text
B
Usable — but review before you trust it
Safety grade
B
76/100 · gate: review
Token cost
2,343
around median
Efficacy
—
Not yet measured
What it claims to do
Use when backfilling missing image alt text on a Shopify store: images with no alt attribute, accessibility alt text for product images, alt text for Files library images, image SEO, or a WCAG/accessibility pass that flags images missing te…
What we found · 7
- Bloated: high token costmedium~2,343 tokens on every single call. Compress instructions and trim examples.
- References API keys / env configmediumReads an API key or env var — normal for API clients. Ensure keys come from the runtime (not hardcoded); a leak risk only if sent to an untrusted endpoint.
- Contains curl / wget network commandmediumAccesses the network from the shell. If the target is untrusted it can pull malware or exfiltrate data.
- Reads credentials and makes network calls — verify the destinationmediumThe normal shape of an API client (your key → the API). Static analysis sees the capability, not the intent — confirm the endpoint is one you trust; it is a data-leak risk only if it is not.
- Description too longlowThe description is read on every trigger check; overly long ones waste tokens and dilute the signal.
- Repeated contentlow~3 duplicate lines detected; de-duping is free token savings.
- Embedded shell script block — in a warninglowAppears inside a prohibition/warning ("never …"), not as an instruction to run. Flagged for awareness only.
What its scripts can do
| high | Reads secrets |
| medium | Network egress |
Have you installed shopify-alt-text? Scan everything you run.
One command grades every skill in your Claude Code / Codex — safety, token bloat, and conflicts, 100% locally.
npx skillmoo scan
Grade computed 2026-07-18 · rubric skillmoo-static/2.0. Efficacy shown only when measured on a labeled model + task suite — never invented.
Show the badge
Add this independent grade to the skill's README — the badge links back to this rating and updates when we re-grade.
[](https://skillmoo.com/skill/shopify-alt-text/)
Independent static analysis by SkillMOO — the Consumer Reports for agent skills. Safety, token, and conflict grades are computed, not opinions. Efficacy is only ever claimed when measured. We rate & link to the source; we do not rehost skill content.