Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Shopify Dev Mcp
v1.0.0Use when user wants to work with Shopify Admin API, Storefront API, validate Liquid code, explore GraphQL schemas, build Shopify apps, or inspect Shopify doc...
⭐ 0· 44·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md clearly targets Shopify Admin/Storefront GraphQL, Liquid, Polaris, and an MCP server (shopify-dev). That purpose matches the commands and examples in the docs. However the skill metadata declares no required env vars/binaries while the documentation shows this workflow depends on @shopify/dev-mcp, mcporter, and Shopify API credentials — a minor mismatch between claimed requirements and documented needs.
Instruction Scope
Instructions are constrained to Shopify workflows (initialize MCP session, search docs, introspect schemas, validate code, manage webhooks). They do not instruct the agent to read unrelated system files or exfiltrate data. They do include operations that interact with external endpoints (webhook addresses) which is expected for webhook management.
Install Mechanism
This is an instruction-only skill (no install spec), which is low risk. The docs recommend installing @shopify/dev-mcp locally or using npx, but that install step is not codified in metadata — the absence of an install spec means the agent may assume tooling is present or request it at runtime.
Credentials
The reference guide shows explicit environment variables (SHOPIFY_API_KEY, SHOPIFY_API_SECRET, SHOPIFY_STORE_URL, LIQUID_VALIDATION_MODE) needed by the MCP server, but the skill metadata lists no required env vars or primary credential. This mismatch could lead the agent to prompt for or rely on sensitive credentials without them being declared up-front.
Persistence & Privilege
The skill is not force-included (always:false) and does not request persistent system-wide changes in its instructions. It does not claim to modify other skills or global agent settings.
What to consider before installing
This skill is broadly coherent with Shopify development tasks, but it references tools and sensitive environment variables that are not declared in the skill metadata. Before installing or using it: 1) expect to need Shopify API credentials (API key/secret and store URL) to use the MCP server — do not paste these into an unknown service; 2) prefer running @shopify/dev-mcp and mcporter from trusted sources (audit the installed package or pin a known-good version); 3) be cautious when the skill or its recommended CLI creates webhooks or posts to external URLs — verify webhook destinations; 4) ask the skill author or publisher for an explicit install spec and a list of required env vars if you need to run this in a shared environment. If you want me to, I can list the exact places in the SKILL.md that mention credentials and external commands or suggest a safer deployment checklist.Like a lobster shell, security has layers — review code before you run it.
latestvk9732jq8zpn5rdj4msccaak53d84sm9p
License
MIT-0
Free to use, modify, and redistribute. No attribution required.