Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Shopify Ambassador Program
v1.0.0Design and launch a brand ambassador program for Shopify stores to build a network of authentic advocates who drive sales and awareness. Triggers: ambassador...
⭐ 0· 52·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's name, description, and SKILL.md content are coherent with a marketing/strategy helper for Shopify merchants. However, the included analyze.sh invokes a local 'openclaw' CLI which is not listed in the skill's required binaries; requiring a local agent binary to generate the output is unexpected for a content/design skill.
Instruction Scope
SKILL.md itself describes marketing deliverables and does not request secrets or system files. The shipped analyze.sh constructs a prompt and runs 'openclaw agent --local --message ... --session ...', meaning executing the script will spawn a nested local agent process. The script does not read environment variables or external files, and it does not send data to remote endpoints directly, but it does rely on a local binary and will execute a child process.
Install Mechanism
No install spec is present (instruction-only plus a script). Nothing in the manifest downloads or extracts remote code. The only on-disk file is analyze.sh which is readable; risk comes from executing it, not from a remote install step.
Credentials
The skill declares no required environment variables, credentials, or config paths. The script does not reference secrets or external service tokens. That is proportionate to the stated purpose.
Persistence & Privilege
always is false and there are no indications the skill requests persistent system privileges or modifies other skills/config. The only noteworthy behavior is that the script runs a local agent process, but it does not enable permanent presence.
What to consider before installing
This skill appears to legitimately produce a brand ambassador program blueprint, but the included analyze.sh will run a local 'openclaw' CLI (openclaw agent --local ...) when executed. The manifest does not declare this required binary, so: (1) don't run the script unless you know and trust the openclaw binary on your system; (2) inspect the script (it's plain text) and confirm you are comfortable with it spawning a child process; (3) if you only want the strategy output, ask the author to either (a) include the generated content directly in SKILL.md, (b) update metadata to declare 'openclaw' as a required binary, or (c) remove the nested agent invocation and provide a pure instruction-only version; (4) if you run it, prefer a sandboxed environment and ensure no sensitive credentials are present in that environment.Like a lobster shell, security has layers — review code before you run it.
latestvk97d5w8b0c72x7ha0qt09s3vp983mnc6
License
MIT-0
Free to use, modify, and redistribute. No attribution required.