Firm Ecommerce Pack

PassAudited by ClawScan on May 10, 2026.

Overview

This is an instruction-only e-commerce orchestration bundle; it has no code or credentials, but users should review the optional multi-agent setup and any financial actions before use.

This skill appears benign as an instruction-only e-commerce orchestration bundle. Before using it in a real store or support workflow, review any companion skills you install, keep customer/payment data minimized, and require explicit approval for refunds, public content, deployments, or other business-changing actions.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the recommended companion skills may add new capabilities, integrations, or account access that this bundle itself does not contain.

Why it was flagged

The skill recommends installing multiple companion skills from ClawHub. This is expected for a bundle, but those additional skills are outside this artifact set and should be reviewed separately.

Skill content

npx clawhub@latest install activecampaign ... airtable-automation ... biz-reporter ... firm-orchestration ... firm-delivery-export

Recommendation

Review each recommended skill’s permissions, credentials, and behavior before installing it.

Low

#ASI02: Tool Misuse and Exploitation

What this means

If combined with commerce or payment tools, an agent could interpret this workflow as permission to issue refunds.

Why it was flagged

A sample prompt describes automatic refunds. The skill does not provide payment credentials or refund code, and the example is user-directed, but real refund actions would be financially impactful if connected through other tools.

Skill content

constraints: ["SLA: 24h response", "auto-refund for orders < €50"] ... definition_of_done: "Resolution report: refunds processed, root cause, prevention plan"

Recommendation

Require explicit confirmation before processing refunds, credits, customer messages, or other account-changing actions.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Information shared during orchestration may be sent between spawned sessions or reused from session history.

Why it was flagged

The skill declares session send, spawn, and history tools, indicating multi-agent/session orchestration. This aligns with the firm-pack purpose but can move context between sessions.

Skill content

tools:
      - sessions_send
      - sessions_spawn
      - sessions_history

Recommendation

Avoid including unnecessary sensitive customer, payment, or business data in orchestration prompts, and verify how companion orchestration tools handle session boundaries.

Info

#ASI06: Memory and Context Poisoning

What this means

Project artifacts, summaries, or context may persist locally and influence later work.

Why it was flagged

The suggested configuration uses a persistent local workspace path. This is normal for project orchestration, but outputs and context may remain available for later tasks.

Skill content

"workspace": "~/.openclaw/workspace/ecommerce-firm"

Recommendation

Use a dedicated workspace for each business/client context and clean it up when no longer needed.