ucp
Use when the user wants to use the UCP CLI to find, compare, buy, or track products from online merchants, or to set up and troubleshoot the local UCP profile required for merchant-scoped operations. Covers global catalog search ("find me X under $Y"), named-merchant transactions ("buy this from Z.com"), order tracking, `ucp profile init`, `ucp doctor`, carts, checkout, orders, and UCP setup/help. Falls back to merchant-hosted handoff when direct in-protocol checkout isn't available.
Security Assessment
About ucp
UCP is a commerce toolkit driven through the `ucp` CLI for finding, comparing, buying, and tracking products from online merchants, and for setting up and troubleshooting the local UCP profile that merchant-scoped operations require. When a buyer expresses commercial intent, the skill can search across thousands of merchants via a bundled global catalog, build carts and complete checkouts against any UCP-supporting merchant, and follow up on orders. For merchants that do not support direct in-protocol transactions, it hands off gracefully to the merchant's own flow.
Routing depends on whether a merchant is named. Broad product discovery ("find me X under $Y") uses `ucp catalog search` against the global catalog, where each result names its merchant via seller.domain and no `--business` flag is needed. Business-scoped operations -- cart, checkout, order, or catalog scoped to a specific merchant -- pass `--business <url>`. When a buyer names a merchant, the agent runs `ucp discover --business <url>` first; if it succeeds the merchant speaks UCP and the transaction proceeds, and if it fails the agent tells the buyer and offers alternatives. Order tracking uses `ucp order get <order_id> --business <url>`. Any merchant-scoped flow first needs a local profile, created idempotently with `ucp profile init --name <local-profile-name>`, where the profile name is just a local label and `agent` is a fine default; global catalog discovery works without this setup, so broad search is not blocked on it.
Introspection keeps the agent from guessing: `ucp discover --business <url>` returns the operations and tools a merchant exposes, and `ucp <op> --input-schema --business <url>` returns an operation's input schema before non-trivial checkout, fulfillment, or extension payloads. Journey heuristics guide behavior -- search immediately for broad requests, re-run with a sharper query on refinement, lead with the key tradeoff on comparison, pass locality context on cart creation, preserve line_items on every checkout update, and treat orders as read-only post-purchase status. When the user explicitly asks to set up or troubleshoot UCP, the skill surfaces a diagnostic sequence of `ucp doctor` and `ucp profile init`. A telemetry logging step runs on activation, and the CLI binary `ucp` is required.
FAQ
When do I need to pass --business and when not?
Broad product discovery with `ucp catalog search` works against the global catalog with no `--business` flag. Business-scoped operations -- cart, checkout, order, or catalog scoped to a specific merchant -- pass `--business <url>`.
What happens if a named merchant does not support UCP?
The agent runs `ucp discover --business <url>` first; if it fails, the merchant does not speak UCP. The skill tells the buyer and offers alternatives, falling back to the merchant's own hosted flow when direct in-protocol checkout is unavailable.
Do I need to set up a local profile before searching?
Global catalog discovery with `ucp catalog search` works without local setup, so broad search is not blocked on it. Any merchant-scoped flow first needs a local profile created with `ucp profile init --name <local-profile-name>`, which is idempotent.
How do I avoid guessing a merchant's operations and fields?
Use `ucp discover --business <url>` to see the operations and tools a merchant exposes, and `ucp <op> --input-schema --business <url>` to get an operation's input schema before composing non-trivial checkout, fulfillment, or extension payloads.
How do I track an order?
Use `ucp order get <order_id> --business <url>`. Orders are read-only post-purchase status, so summarize fulfillment expectations and tracking events and do not invent return or reorder actions unless the response supports them.
Install ucp
Quick Setup:
- Copy the skill folder to
.claude/skills/ - Claude will automatically detect and use the skill
Repository
shopify/shopify-ai-toolkit