Creem Store Agent

AI-powered Creem store monitor — alerts, churn analysis, autonomous actions via Telegram

Security Scan

The skill's code, environment variables, and runtime instructions match its stated purpose (monitor Creem webhooks, analyze churn with Anthropic/Claude, notify via Telegram, and optionally perform Creem actions); nothing requested is unrelated or unexplained.

Purpose & Capability

Name/description align with required binaries and environment variables. CREEM_API_KEY, CREEM_WEBHOOK_SECRET, TELEGRAM_BOT_TOKEN/CHAT_ID, and ANTHROPIC_API_KEY are all plausibly required for: verifying webhooks, calling Creem SDK, sending Telegram messages, and calling Anthropic. The code imports/uses the listed SDKs (creem, @anthropic-ai/sdk, node-telegram-bot-api) and implements the features described (webhook handler, LLM analyzer, action executor).

Instruction Scope

SKILL.md and code instruct the agent to register an HTTP webhook route, verify HMAC signatures, fetch context from Creem, call Anthropic for analysis, and send Telegram messages; these are within the stated scope. Important behavioral detail: the skill can autonomously auto-execute billing-impacting actions (create discounts, pause subscriptions) when the LLM confidence >= 80%. This is a deliberate capability but has real financial impact and should be considered by operators. Demo code also reads a local .env for convenience (development only).

Install Mechanism

There is no installer that downloads arbitrary code at runtime — the repository is instruction-and-code based and relies on normal npm packages declared in package.json (creem, @anthropic-ai/sdk, node-telegram-bot-api). No suspicious download URLs or extract steps are present in the provided metadata.

Credentials

Requested environment variables (CREEM_API_KEY, CREEM_WEBHOOK_SECRET, TELEGRAM_BOT_TOKEN, TELEGRAM_CHAT_ID, ANTHROPIC_API_KEY) are directly required by the functionality. No unrelated credentials (cloud provider keys, DB passwords, etc.) are requested. CREEM_API_KEY is defined as primaryEnv which matches the skill's ability to act on subscriptions/discounts.

Persistence & Privilege

The skill registers an HTTP route (ctx.api.registerHttpRoute) and runs code that can autonomously call Creem APIs to modify subscriptions or create discounts. It does not request 'always: true' and uses in-memory pending state (no persistent system-wide config changes). The combination of autonomous invocation with write-capable Creem credentials is intended but increases blast radius — operators should be aware and control the auto-execute threshold and credentials provided.

Assessment

This skill appears to do exactly what it claims: receive and verify Creem webhooks, analyze churn with Anthropic/Claude, notify via Telegram, and optionally call Creem to create discounts or pause subscriptions. Before installing or enabling it for production, consider the following: - Financial impact: the agent can auto-execute retention actions (create discounts or pause subscriptions) when LLM confidence ≥ 80%. If you don't want automatic changes, keep it in manual-approval mode or lower privileges on the Creem API key. - Test in sandbox: run the demo with test Creem credentials and a test Telegram chat to confirm behavior and button flows before connecting to a live store. - Least privilege: create a Creem API key scoped as narrowly as possible (if Creem supports scoped keys) and rotate it regularly. Limit the Telegram bot's chat permissions and keep TELEGRAM_CHAT_ID restricted to authorized operators. - Monitor and logs: ensure you have visibility (logs/alerts) for every auto-executed action so you can audit and revert if needed. - Review dependencies and run tests: the repo includes tests and uses common npm packages; run npm audit and the included test suite locally if you want extra confidence. If you want to be extra cautious, omit ANTHROPIC_API_KEY (fallback rule-based behavior is present) or disable autonomous execution in configuration before connecting to a production Creem key.

AI-powered monitoring for your Creem store. Sends real-time Telegram alerts for sales, subscriptions, disputes, and refunds. Uses Claude AI to analyze churn events and autonomously recommend retention actions.

Commands

• /creem-status — Check store connection and webhook status
• /creem-report — Daily revenue summary (MRR, churn, new sales)

Features

• Real-time alerts: Formatted Telegram notifications for all Creem events
• AI churn analysis: Claude Haiku analyzes cancellations and recommends retention actions
• Autonomous actions: Create retention discounts or pause subscriptions via inline buttons
• Event deduplication: Handles Creem webhook retries gracefully
• HMAC verification: Validates webhook signatures for security

Setup

1. Install: clawhub install creem-store-agent
2. Set environment variables (see .env.example)
3. Expose webhook URL: ngrok http 3000 (development)
4. Register webhook in Creem dashboard: https://your-ngrok-url.ngrok.io/webhook/creem

Environment Variables

Variable	Description
CREEM_API_KEY	Creem API key (test: creem_test_xxx)
CREEM_WEBHOOK_SECRET	Webhook signing secret from Creem dashboard
TELEGRAM_BOT_TOKEN	Telegram bot token from @BotFather
TELEGRAM_CHAT_ID	Telegram chat ID for notifications
ANTHROPIC_API_KEY	Anthropic API key for Claude Haiku