Security audit
Security checks for vulnerabilities and agentic risk
This skill explains a planned Smile.io integration and submits waitlist details only after explicit user permission.
This is a preview and waitlist helper, not an operational Smile.io connector. Joining shares your email, role, and optional URL/message with Agiexa for launch notifications. Review permissions separately before connecting future integrations; the package alone does not verify the provider's security claims.
The waitlist endpoint and Smile.io interest message match the declared subject and supported action. However, the description explicitly conditions registration on user permission, while the supplied code submits immediately and sets consent to true without any visible authorization check. The mismatch is the missing consent gate, not the use of an HTTP request.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
openclaw:
requires:
bins:
- curl
homepage: https://agiexa.com/integrations/smile-io
---
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Apps: Smile.io, Shopify
- Tools: `SMILE_FIND_CUSTOMER`, `SMILE_POINTS_HISTORY`, `SMILE_LIST_REWARDS`
> Find Shopify customers who previously purchased repeatedly but have not ordered recently, using the date range I specify. Match them with Smile.io loyalty profiles using reliable customer identifiers, such as email where permitted. For each customer, report the last order date and previous order count, historical spend if available, current points balance, available rewards and redemption requirements, and a suggested win-back message angle. Rank customers using observable purchase recency and frequency. Do not claim a customer is likely to churn without sufficient evidence. Respect marketing consent and communication preferences. Draft suggested campaign segments and messages, but do not send marketing communications or adjust points without approval.
## Discover Unused Loyalty Reward Opportunities
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Apps: Smile.io, Shopify
- Tools: `SMILE_GET_PROGRAM`, `SMILE_FIND_CUSTOMER`, `SMILE_POINTS_HISTORY`
> Review my Smile.io loyalty program configuration to understand its VIP tiers, qualifying milestones, and associated perks. Compare those requirements with Shopify customer purchase information and identify customers who are close to the next tier. For each customer, show the current tier, the next tier and its documented requirements, confirmed progress, relevant purchase history, the remaining qualifying amount or activity if calculable from the available rules, and relevant products to recommend. Do not assume all Shopify revenue counts toward VIP qualification. Account for only the qualification rules that are explicitly available. Prepare a campaign proposal that communicates genuine benefits without pressuring customers to spend unnecessarily. Do not change tiers, customer records, or send campaigns without approval.
## Investigate Loyalty Points Discrepancies
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Apps: Smile.io, Shopify
- Tools: `SMILE_LIST_ISSUED_REWARDS`, `SMILE_FIND_CUSTOMER`, `SMILE_LIST_REWARDS`
> Review Smile.io issued rewards for customers matched to Shopify profiles. Identify rewards with a confirmed expiration date or other documented time-sensitive restriction. Compare those records with recent Shopify purchase activity to prioritize relevant opportunities. For each match, provide the customer identifier, issued reward and current status, confirmed expiration date or restriction if available, relevant purchase history, and a suggested reminder message. Do not assume that a reward expires unless its status or rules explicitly confirm that. Do not confuse an available reward with a reward already issued to a customer. Prepare a reminder campaign proposal and flag missing expiration information. Do not send messages or issue rewards without approval.
## Prepare Personalized Loyalty Campaigns