ClawHub

Shopify Ad Attribution

v1.0.0

Shopify ad attribution agent. Calculates true ROAS per channel by correlating Shopify order UTM data with ad spend — reveals which channels actually drive pr...

⭐ 0· 90·1 current·1 all-time
by@mguozhen
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name and description match the instructions: the agent expects pasted Shopify order UTM data, channel spend, and configuration, and produces ROAS/attribution reports. It declares no external integrations, binaries, or credentials — which is proportionate to an analysis-only skill.
ℹ
Instruction Scope
SKILL.md confines operations to local analysis of pasted CSV/export data and creating files under ~/shopify-attribution/. It does not request external network calls or other system files. Note: the agent will create and store potentially sensitive order/customer data in the user's home directory, so users should avoid pasting PII (payment data) and should review/delete workspace files when finished.
✓
Install Mechanism
No install spec and no code files — lowest-risk setup. Nothing is downloaded or written beyond the workspace the skill itself documents.
✓
Credentials
The skill does not request environment variables, credentials, or config paths. This is appropriate for a tool that operates on user-pasted exports locally.
✓
Persistence & Privilege
always is false and the skill is user-invocable. It writes its own workspace under the user's home directory (~/shopify-attribution/), which is reasonable for local-report persistence and does not modify other skills or system-wide settings.
Assessment
This skill appears coherent and does not request credentials or install code, but take standard precautions: (1) Do not paste raw PII or payment info — paste only the UTM/relevant order columns. (2) Inspect the created ~/shopify-attribution/ files and delete them when done. (3) The SKILL.md lists allowed-tools: Bash, which means the agent could run shell commands depending on platform policies — run the skill in a restricted/sandboxed session if you are concerned about shell access. (4) If you want more assurance, review the upstream repository linked on the homepage before use and test with anonymized/sample data first.

Like a lobster shell, security has layers — review code before you run it.

latestvk978n9fvhn3885fmj11y028j31839q5g

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments