Shopify Manager Cli
v1.0.3Manage Shopify store — products, metafields, metaobjects, blogs & articles via Shopify Admin GraphQL API. Pure official Shopify API wrapper with no third-par...
⭐ 1· 265·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the actual files and behavior: a Python-only Shopify Admin GraphQL wrapper. Required binaries and env vars (SHOPIFY_STORE_URL, SHOPIFY_ACCESS_TOKEN) are appropriate for this purpose. One minor inconsistency: registry metadata lists SHOPIFY_API_VERSION as required, while the SKILL.md and the script treat it as optional with a default — this is a small metadata mismatch, not a functional problem.
Instruction Scope
SKILL.md instructions stay within the stated scope (map user intent to CLI subcommands, run python3 scripts/shopify_admin.py). The instructions explicitly allow passing local file paths which the script will read and upload — this is expected for image/file upload functionality but does mean the agent will read any local path you supply. The instructions do not ask for unrelated system files or other credentials.
Install Mechanism
No install spec; the skill is instruction+bundled Python scripts and relies on the system python3. Nothing is downloaded or written to disk by an installer, so install risk is low.
Credentials
Requested environment variables (STORE URL, ACCESS TOKEN, optional API version) and the declared primary credential (SHOPIFY_ACCESS_TOKEN) are proportionate and expected for a Shopify Admin CLI. No unrelated secrets or config paths are requested.
Persistence & Privilege
always is false and the skill does not request persistent/privileged presence or modify other skills. Autonomous invocation is allowed (platform default) but not combined with other concerning factors.
Assessment
This skill appears to do what it says: it runs a bundled Python CLI that calls your Shopify Admin GraphQL API. Before installing, ensure you: (1) only supply a Shopify Admin access token (shpat_…) created for a custom app with the minimal scopes you need; (2) understand that any local file path you pass (e.g., for --image-file or file upload) will be read by the script and uploaded to Shopify — do not pass sensitive local files; (3) confirm delete operations when prompted (SKILL.md already instructs confirmation); and (4) be comfortable that the skill will make network calls to your store URL and any staged-upload targets returned by Shopify. The small metadata mismatch about SHOPIFY_API_VERSION being 'required' in registry metadata but optional in the script is benign but could be fixed for clarity.Like a lobster shell, security has layers — review code before you run it.
latestvk975vd3abhd0h22fvtn7jxfv4582m12b
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🛍️ Clawdis
Binspython3
EnvSHOPIFY_STORE_URL, SHOPIFY_ACCESS_TOKEN, SHOPIFY_API_VERSION
Primary envSHOPIFY_ACCESS_TOKEN