Security audit
Shopify Store Optimizer
Security checks across malware telemetry and agentic risk
Overview
The skill's code, instructions, and manifest are coherent with its stated purpose (offline diagnostics and built-in templates); it does not request credentials or declare network installs, and no obvious exfiltration behavior is present.
This skill appears to do what it claims: offline, template-based Shopify diagnostics with no credential access or network calls. Before installing, you should: (1) review handler.py locally (run the included tests: python3 tests/test_handler.py) to confirm behavior in your environment; (2) note that the skill's owner and homepage are unknown — treat recommendations as informational and verify any third‑party apps yourself before installing them on your store; (3) be aware SKILL.md mentions a .claw/identity.json in acceptance criteria but that file is missing from the manifest (a minor metadata inconsistency); and (4) if future versions add API connectivity, require explicit credentials or network access, re-evaluate permissions and data-flow before enabling. Overall: coherent and low-risk as distributed.
VirusTotal
No VirusTotal findings
Static analysis
No suspicious patterns detected.