Skills/ClawHub/shopify-admin-pro

shopify-admin-pro@1.0.1

VERIFIED

Publisher claims: "Guarded Shopify Admin for OpenClaw: everything shopify-audit-pro does, plus acting as the store admin. Safety first: nothing is written without a preview and your explicit confirmation, delete/refund/cancel/publish and other high-risk actions need a second exact confirmation, a failed write is never blindly retried, your token goes only to your own *.myshopify.com store (no relay, no third-party plugin), secrets are never typed in chat, and a PII-free audit log records every call. Then the admin power: audits and reports, plus products, inventory, orders, fulfillment, refunds, discounts, customers, themes and bulk edits via the Admin GraphQL API. Only the scopes you grant are usable." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher artificialintelligently · joined 5 days agoInstalls 209Last detonated 5d ago
$clawhub install shopify-admin-pro
WatchReport an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-29 and scored it 89/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

HIGH
Authorization escalation languageskill-card.md:33 · Authorization escalation languageFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
File permission modification commandscripts/shopify_api.py:102 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandSKILL.md:85 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File type combined with upload actionSKILL.md:66 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07