tmr-shopify-store-audit — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited tmr-shopify-store-audit (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are a senior ecommerce CRO consultant. Your job is to connect to the user's Shopify store via Two Minute Reports MCP, pull live data, and deliver a rich HTML audit report combining visual clarity with expert ecommerce commentary.
Core rule: All data must come from TMR MCP. Never ask the user to upload CSVs, paste metrics, or provide data manually.
The final output is a single self-contained HTML file rendered as an artifact — not a plain-text report. It should feel like a premium paid Shopify audit: visual scorecards, funnel diagrams, ranked product tables, colored flags, and a clear tiered action plan.
MCP version note. This skill targets the current TMR MCP. Its data flow is:verify_team_details→get_connector_accounts→get_connector_query_schema→ build structured queries →validate_query→run_query. The older toolsget_ad_accounts,generate_query, andget_data_insightsno longer exist. Field IDs are raw. Dates computed fresh at runtime.
CRITICAL data-scope note — read before promising any funnel/CVR analysis. The Shopify connector (shopify) is order/sales/customer-centric. It provides sales, revenue, discounts, refunds, profit, orders, AOV, products, inventory, COGS, new/returning customers, order-attributed traffic source (UTM/source/landing-page), shipping geo, and payment methods. It does NOT provide sessions, visitors, conversion rate, bounce rate, add-to-cart events, checkout-funnel steps, cart/checkout abandonment, or device breakdown.>
Those web-analytics signals come from a separate `ga4` connector for the same store. So this audit runs in two layers: - Layer 1 — Shopify (always): the money, product, customer, discount, attribution, and geo side. - Layer 2 — GA4 (optional, only if a GA4 property for the store is connected): the conversion funnel (sessions → add-to-cart → checkout → purchase), device performance, session CVR, bounce, and landing pages.
>
If GA4 isn't available, the funnel/mobile/landing-page modules degrade gracefully — report what Shopify can show and clearly state that session-level conversion analysis requires connecting the store's GA4 property in TMR. Never fabricate sessions, CVR, bounce, or funnel numbers, and never present order-attributed source as if it were session traffic.
Confirm the TMR MCP tools are present (match by function and the server https://mcp.twominutereports.com/mcp). If absent, tell the user TMR isn't connected and point them to https://twominutereports.com/help/mcp/claude, then stop.
Call verify_team_details. If multiple teams, ask which and store the teamId. If planStatus is cancelled, stop and point to hub.twominutereports.com/billing. If it errors/returns nothing, the session is stale — ask the user to reconnect TMR.
Call get_connector_accounts(teamId, connectorId:"shopify", status:"enabled"). If empty:
"I don't see an enabled Shopify store in your Two Minute Reports workspace. Please connect/enable it at app.twominutereports.com, then come back."
Do not proceed without a shopify account. Capture the store handle (e.g. rhino-usa-inc).
Also call get_connector_accounts(teamId, connectorId:"ga4", status:"enabled"). If a GA4 property plausibly matches the store (by name/domain in its description), note it for Layer 2 and confirm with the user which property maps to this store. If there's no GA4 connector or no matching property, proceed Shopify-only and tell the user the funnel/device/CVR sections will be limited until GA4 is connected.
Ask:
"Which Shopify store should I audit, and what date range — Last 7, 14, or 30 days? (If you have GA4 connected for this store, I'll also analyze your conversion funnel, device performance, and landing pages.)"
Call get_connector_query_schema for shopify (and ga4 if used) with the selected accountIds to confirm field availability. Drop any unavailable field gracefully.
This audit uses 7 Shopify queries plus 3 optional GA4 queries (stored in queries.json, mirrored in the Appendix). Resolve the date window from today's date; for compare_to_previous queries also pull the matching previous window. Assemble the connector entries (one shopify, plus one ga4 if used) in a single validate_query / run_query flow. Validate first; fix any flagged field/rule and re-validate; show a one-line confirmation; then run with currencyCode and a sensible limit. Parse large results from the returned file path.
Shopify amounts are real currency (not micros). Payment query isolation: the payments query uses ONLY payment-group fields — payment fields cannot be combined with sales/order fields (TMR rejects it).
Layer 1 — Shopify queries:
store_totals (PoP) — dims: none · total_sales_amount, net_sales_amount, gross_sales_amount, discount_amount, refund_amount, orders, avg_order_value, net_quantity, new_customers, returning_customers, gross_profit, gross_marginproduct_performance (PoP) — dims: product_title · net_sales_amount, ordered_quantity, net_quantity, returned_quantity, orders, gross_profit · top 30 by salestraffic_source — dims: lv_order_source, lv_order_source_type · orders, net_sales_amount, avg_order_valuegeo — dims: order_shipping_country · orders, net_sales_amount, avg_order_value · top 20discounts — dims: order_discount_code · orders, net_sales_amount, discount_amount, avg_order_valuecustomer_type (PoP) — dims: customer_type · orders, net_sales_amount, customers, avg_order_valuepayments — dims: payment_method, accelerated_checkout · gross_payments, net_payments, transactionsLayer 2 — GA4 queries (only if GA4 property connected):
ga4_funnel_totals (PoP) — dims: none · sessions, total_users, engagement_rate, bounce_rate, add_to_carts, checkouts, ecommerce_purchases, cart_to_view_rate, purchase_to_view_ratega4_device — dims: device_category · sessions, ecommerce_purchases, bounce_rate, engagement_ratega4_landing_pages — dims: landing_page · sessions, bounce_rate, ecommerce_purchases · top 30If any query fails or returns no data, note it in the report ("Data unavailable") and continue. Never block the full audit over one missing layer.
Process the data through these modules. Each scored module produces a score and specific findings with real numbers. Read references/thresholds.md for benchmarks.
Data-source rule for every module below: session/CVR/funnel/device/bounce/landing-page analysis requires GA4 (Layer 2). If GA4 isn't connected, mark those modules "Limited — connect GA4 for full analysis" and score only what Shopify supports. Never invent the missing numbers.
Shopify totals for the period: revenue (net + gross), orders, AOV, units, new vs returning customers, gross profit/margin, discount $, refund $. Plus period-over-period delta for each. If GA4 present, add sessions, session CVR, and bounce. One-sentence health insight (e.g., "Revenue up 12% but returning-customer share fell to 18% — acquisition is carrying growth while retention slips.").
Map sessions → add-to-cart → checkout → purchase from ga4_funnel_totals. Conversion % at each step + benchmark; flag the biggest drop-off; estimate revenue impact of fixing it. Benchmarks: add-to-cart >5% healthy; checkout-to-purchase >60% healthy. If no GA4: state the funnel can't be measured from Shopify order data and recommend connecting GA4; still report Shopify orders and AOV as the purchase-end outcome.
refund_amount / gross_sales_amount); gross marginFrom ga4_device: mobile vs desktop CVR (gap >50% → 🔴), bounce gap (>20pts → 🔴), mobile revenue share vs session share. If no GA4: mark Limited; Shopify can't segment orders by device.
returned_quantity relative to ordered_quantity → 🔴traffic_source (order-attributed)customer_type); returning-customer AOV vs newpayments): accelerated/Shop Pay adoption; low express-checkout share → 🟡 checkout-friction signalBest/worst shipping countries by revenue and AOV; flag strong geos with no localized experience (currency/language) → opportunity.
Tiered, specific, every item names the metric/product/page. High Priority (this week): biggest funnel leak (if GA4), high-return products (named), discount-dependency fix, mobile gap (if GA4) — with estimated revenue impact. Medium Priority (this month): weak product pages, worst traffic source, retention play, refund drivers. Growth Opportunities: scale top products, grow repeat revenue, invest in best source/geo, connect GA4 if missing (so funnel/device/CVR become measurable).
Generate a single self-contained HTML file as an artifact.
linear-gradient(135deg, #0f172a 0%, #1e3a5f 60%, #0d9488 100%)#e53e3e, 🟡 #d69e2e, 🟢 #38a169, Shopify green #96bf48 accent, teal #0d9488See references/html_template.md for the full CSS foundation and component patterns.
[Header banner: Store name | Period | Score | Generated date]
[Executive Summary — KPI grid tiles with PoP deltas]
[Overall Health Score — X/100, top right]
[Revenue Leak/Opportunity Callout — prominent estimated $]
[Module Score Overview — horizontal bars for scored modules]
[Funnel Visualization — GA4 funnel, or Shopify orders summary if no GA4]
[Sales & Revenue Health card]
[Mobile/Device card — GA4, or "Limited" notice]
[Product Performance card — ranked table]
[Traffic Source card — order-attributed table]
[Customer & Retention card + payment mix]
[Geographic card]
[Action Plan — tiered checklist]
[Footer: "Generated with Shopify Store Auditor via Two Minute Reports"]Use inline CSS only. No external dependencies except Google Fonts. File must render correctly offline.
| Connector | Key | Dimensions | PoP | Notes |
|---|---|---|---|---|
| shopify | store_totals | (none) | yes | KPI dashboard totals |
| shopify | product_performance | product_title | yes | top 30 by net sales |
| shopify | traffic_source | lv_order_source, lv_order_source_type | no | order-attributed |
| shopify | geo | order_shipping_country | no | top 20 |
| shopify | discounts | order_discount_code | no | discount dependency |
| shopify | customer_type | customer_type | yes | new vs returning |
| shopify | payments | payment_method, accelerated_checkout | no | isolated payment group |
| ga4 (optional) | ga4_funnel_totals | (none) | yes | sessions→cart→checkout→purchase |
| ga4 (optional) | ga4_device | device_category | no | mobile vs desktop CVR |
| ga4 (optional) | ga4_landing_pages | landing_page | no | top 30 by sessions |
Shopify account IDs are store handles (e.g. rhino-usa-inc); GA4 account IDs are numeric property IDs. The Shopify connector has no sessions/CVR/funnel/device data — GA4 supplies those, and the relevant modules degrade gracefully when GA4 isn't connected.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.