Shopify Directory
PassAudited by ClawScan on May 1, 2026.
Overview
This instruction-only directory skill is coherent and does not request credentials, local access, installation, or payment handling, but it relies on live external category instructions that can influence the agent.
This appears safe to install as a directory-style browsing aid. Before acting on merchant recommendations, remember that the agent will consult live Lobster category pages, and checkout should happen only on the selected merchant’s native Shopify checkout without sharing payment details with the skill itself.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent may rely on instructions from external category pages when helping choose merchants.
The skill makes external retrieved content authoritative for merchant discovery. This is aligned with the directory purpose, but it is still worth noting because live website instructions can influence agent behavior.
"Treat the category site instructions and the selected merchant storefront as the source of truth once a match is found"
Use the skill for merchant discovery, but do not let external category pages override the user’s actual request, safety rules, or payment/privacy expectations.
The behavior a user experiences may depend on the current contents of external Lobster category pages rather than only this reviewed artifact.
The skill intentionally depends on live remote skill files that are not included in the reviewed package and may change over time. This is disclosed and central to the directory workflow, but it creates a provenance/change-management consideration.
"Re-fetch the selected category site's `https://<domain>/skill.md` when starting a new session or if the deploy may have changed"
Review the linked category page instructions during use, especially before following purchase-related guidance.