setup-weaverse-project — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited setup-weaverse-project (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Take a user from nothing to a running, connected Weaverse Hydrogen storefront. This is the front door. Every other Weaverse skill assumes the project already exists — this one creates it.
Boot a live preview on the demo store BEFORE asking for any credentials.
Most users quit onboarding because they hit a wall (GitHub, Shopify tokens, CLI) before they ever see anything work. Pilot ships with a working demo store's tokens in .env.example, so you can show a real, running storefront in ~2 minutes with zero credentials. Do that first. Get the "wow." Then make it theirs.
Do not make the user create a GitHub repo, link a Shopify store, or paste tokens before they have seen the storefront running. If you do, you have failed the onboarding even if every command succeeds.
The user (merchant or developer) should never have to type a CLI command. You run shopify hydrogen and @weaverse/cli under the hood. The Shopify CLI does real work (env pull, dev server, codegen, deploy) — drive it, do not reimplement it. npm run dev itself shells out to shopify hydrogen dev, so the CLI is always involved; just keep it invisible to the user.
Before doing anything, detect and record (do not assume):
node --version # need >= 18
git --version
gh --version 2>/dev/null && gh auth status 2>/dev/null # is GitHub CLI present AND authed?
npx shopify version 2>/dev/null # Shopify CLI availability
ls package-lock.json pnpm-lock.yaml yarn.lock 2>/dev/null # infer package managerBranch all later steps off this. If gh is missing or not authed, you will use the manual repo fallback in Phase 5. If node < 18, stop and tell the user to upgrade.
Weaverse themes are public GitHub repos at https://github.com/Weaverse/{theme-handle} (e.g. pilot, naturelle, …). Use the theme handle from your project details (the setup prompt includes it; default is pilot). Clone it, then detach from Weaverse's git history so it becomes the user's own project.
# Replace {theme-handle} with the theme from your project (e.g. pilot, naturelle)
git clone https://github.com/Weaverse/{theme-handle} my-storefront
cd my-storefront
rm -rf .git
git initUse clone/degit-style download — do not hand-roll a file downloader. If the theme handle is missing, default to pilot.
This is the centerpiece. Get a live preview running with the demo credentials that ship in .env.example.
cp .env.example .env # ships working demo-store tokens + a demo WEAVERSE_PROJECT_ID
npm install # or pnpm/yarn per Phase 0 detection
npm run dev # boots `shopify hydrogen dev` on http://localhost:3456Then verify it actually came up before saying anything succeeded:
curl -sf -o /dev/null -w "%{http_code}" http://localhost:3456 # expect 200Tell the user, in plain language:
"Your storefront is running locally at http://localhost:3456 — this is the Weaverse demo store. Next we'll make it yours."
Do not proceed to credentials until the preview is up and verified.
Now swap the demo store for the user's store. The minimum vars needed to render a Weaverse preview are:
SESSION_SECRET — any random stringPUBLIC_STORE_DOMAIN — their-store.myshopify.comPUBLIC_STOREFRONT_API_TOKEN — Storefront API access tokenWEAVERSE_PROJECT_ID — see Phase 4 (this is the only var that can't come from Shopify)Everything else (SHOP_ID, PUBLIC_CUSTOMER_ACCOUNT_API_CLIENT_ID, PUBLIC_CHECKOUT_DOMAIN, PUBLIC_STOREFRONT_ID, analytics, reviews) is feature-complete extra — set it after first success, never block on it.
npx shopify hydrogen env pull # works ONLY if the storefront is already linkedenv pull populates .env. Done.PUBLIC_STORE_DOMAIN, PUBLIC_STOREFRONT_API_TOKEN, SHOP_ID. Best when they want Oxygen hosting later.Walk them to the exact screen, have them copy each token, and you write it into .env. Re-run the Phase 2 verify after swapping.
Docs: https://docs.weaverse.io/quickstart and https://shopify.dev/docs/storefronts/headless
WEAVERSE_PROJECT_ID + API key)WEAVERSE_PROJECT_ID is the one value that lives only in Weaverse Builder and cannot be derived from Shopify.
Path A — available today (default): The setup prompt generated by Weaverse Builder embeds the project's WEAVERSE_PROJECT_ID (and theme name). Read it from the prompt you were given and write it into .env. If you were not given one, ask the user to copy it from Builder → Project Settings.
Path B — local auth handshake (milestone, may not be live yet): When available, you can run a local authentication handshake that returns the user's WEAVERSE_PROJECT_ID, WEAVERSE_API_KEY, and the ability to register a preview URL and use the Content API directly. If the handshake tooling is present, prefer it. If not, fall back to Path A. Do not assume `WEAVERSE_API_KEY` exists unless the handshake provided it. Once you have the key, you can also give the agent the Weaverse MCP (Phase 8).
Default (if `gh` present and authed from Phase 0):
git add -A
git commit -m "Initial commit: Weaverse Pilot storefront"
gh repo create my-storefront --private --source=. --remote=origin --pushFallback (no `gh`): give numbered manual steps —
git add -A && git commit -m "Initial commit: Weaverse Pilot storefront"
git remote add origin https://github.com/<user>/<repo>.git
git branch -M main && git push -u origin mainNever present "agent does it" and "user does it" as the same step — pick the default from Phase 0 detection, state which path you're taking.
http://localhost:3456 → save.Do not claim success without all green checks:
curl -sf -o /dev/null -w "%{http_code}" http://localhost:3456 # 200
npm run typecheck # passes
npm run build # passes (optional but recommended)Plus confirm the Weaverse preview shows connected in Builder. If any check fails, fix it before reporting done — and report exactly which check failed if you cannot.
Once the project has a WEAVERSE_API_KEY (the Phase 4 Path B handshake, or a Content API key from Builder → Settings → API Keys), offer to add the Weaverse MCP server so the agent can work with this project directly — search the Weaverse docs and read the account's projects, pages (as Portable Text), theme settings, and locales.
npx -y @weaverse/mcp over stdio. Account tools need v2.2.0+; docs searchworks with no key.
WEAVERSE_API_KEY in the MCP client's env block — never in a tracked file.exact per-client snippets are in the docs: https://weaverse.io/docs/developer-tools/weaverse-mcp
This is a convenience for future work — not required to finish setup. Skip it if the user isn't on an MCP-capable agent.
https://github.com/Weaverse/{theme-handle}, default pilot) → rm -rf .git → git init.cp .env.example .env, install, npm run dev, verify 200). ← wow moment.env pull; not linked → Hydrogen channel / Headless app, write the 4 minimum vars).WEAVERSE_PROJECT_ID (Path A from prompt today / Path B handshake later).gh repo create default, manual fallback).npx -y @weaverse/mcp + WEAVERSE_API_KEY) — see Phase 8.| Var | Needed to render? | Source |
|---|---|---|
SESSION_SECRET | yes | any random string |
PUBLIC_STORE_DOMAIN | yes | Shopify (channel/headless app) |
PUBLIC_STOREFRONT_API_TOKEN | yes | Shopify (channel/headless app) |
WEAVERSE_PROJECT_ID | yes | Weaverse Builder (prompt / handshake) |
SHOP_ID, customer-account, checkout, storefront-id, analytics | no (feature-complete) | Shopify / later |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.