shopify-liquid skill validate.mjs fails because package-lock.json resolves to private npm.shopify.io registry

[MikeNewXYZ]

Summary

validate.mjs can't run because required @shopify/theme-check-* dependencies are missing at runtime, and npm install fails because package-lock.json resolves those packages to Shopify's private registry.

Steps to reproduce

1. Install plugin via Claude Code marketplace
2. Trigger the shopify-liquid skill
3. Skill runs validate.mjs, which fails

What it looks like in Claude Code

The skill instructs the AI to validate every code block via validate.mjs. This is what happens:

⏺ Bash(cd skills/shopify-liquid && node scripts/validate.mjs --filename test.liquid --filetype sections --code '...')
  ⎿  Exit code 1
     Error [ERR_MODULE_NOT_FOUND]: Cannot find package '@shopify/theme-check-common'

The AI then tries npm install to fix it, which also fails, creating a loop of broken validation attempts.

Actual behavior

$ node scripts/validate.mjs --filename test.liquid --filetype sections --code '<div>test</div>'

Error [ERR_MODULE_NOT_FOUND]: Cannot find package '@shopify/theme-check-common'
    imported from skills/shopify-liquid/scripts/validate.mjs

npm install also fails:

$ cd skills/shopify-liquid && npm install

npm error code E401
npm error Incorrect or missing password.

package-lock.json points all @shopify/* packages to the private registry:

@shopify/theme-check-node@https://npm.shopify.io/node/...
@shopify/theme-check-common@https://npm.shopify.io/node/...
@shopify/liquid-html-parser@https://npm.shopify.io/node/...
@shopify/theme-check-docs-updater@https://npm.shopify.io/node/...