Ecommerce Manager Claw

Manage ecommerce store backends in real time via their APIs. Use this skill whenever the user mentions their online store, shop, or ecommerce platform — even...

Security Scan

The skill's requested credentials and API usage match its stated purpose, but its runtime instructions ask users to paste high‑sensitivity credentials into the chat and include overly broad trigger language and unverifiable promises about not storing secrets — this is risky and incoherent with safe handling practices.

Purpose & Capability

The skill claims to manage ecommerce backends and its references and credential lists map directly to Shopify, WooCommerce, BigCommerce, Wix, PrestaShop, Magento, Amazon SP-API, Etsy, and Shopware APIs — the requested tokens/keys are what those platforms require.

Instruction Scope

SKILL.md instructs the agent to always ask for platform credentials and to 'always use this skill when the user mentions their store' which is overly broad. It tells the agent to collect long-lived admin tokens/secrets via conversation and reassures users 'these are only used for this session and are never stored anywhere' — a claim the skill cannot enforce or prove. There is no secure input or OAuth redirect flow described, no logging/privacy guidance, and no mechanism shown to prevent credentials being echoed, logged, or exfiltrated.

Install Mechanism

Instruction-only skill with no install, no binaries, and no downloaded code — lowest install risk.

Credentials

Although the exact credentials requested (admin API tokens, client secrets, refresh tokens) are proportional to the task, the skill asks the user to paste these high‑privilege secrets directly into the conversation. There are no limits suggested (e.g., read-only scopes, ephemeral tokens) and no secure handling instructions beyond an unverifiable reassurance.

Persistence & Privilege

The skill itself is not marked always:true and has no install persistence, but its runtime instructions encourage active credential collection whenever a store is mentioned. Combined with normal autonomous invocation, this could lead to the agent prompting for secrets without a clear secure channel or user expectation. The skill does not describe whether it can store tokens, how long it will keep them, or whether logs will contain them.

What to consider before installing

This skill appears to do what it says, but it asks users to provide admin API tokens, client secrets, and refresh tokens directly in chat — which is risky. Before enabling/installing: 1) Do not paste owner-level credentials into a chat window; instead prefer OAuth or short-lived / least-privilege tokens. 2) Ask the skill author how credentials are transmitted, stored, and logged (searchable logs, telemetry, retention). 3) If you must test, create a throwaway store or use a read-only or limited-permission API key and revoke it afterward. 4) Consider disabling autonomous invocation (or require explicit user consent) so it won’t prompt for secrets whenever your store is mentioned. 5) Prefer skills that implement a secure OAuth redirect flow or use platform-native app integrations rather than asking users to paste secrets into free-form chat. If the author cannot justify secure handling and ephemeral/least-privilege tokens, treat the skill as unsafe to use with production credentials.

Ecommerce Store Manager

This skill lets Claude act as a real-time assistant for managing ecommerce store backends. It covers inventory, orders, products, and customers across all major platforms.

---

Step 1 — Identify the Platform & Collect Credentials

Start by warmly asking which platform the user is on if they haven't said. Then ask for the credentials needed (listed below per platform). Reassure them:

"These are only used for this session and are never stored anywhere."

Credential requirements by platform

Platform	What to ask for
Shopify	Store URL (e.g. mystore.myshopify.com) + Admin API Access Token
WooCommerce	Site URL + Consumer Key + Consumer Secret
BigCommerce	Store Hash + API Access Token
Wix	Site ID + API Key (from Wix Dev Center)
PrestaShop	Store URL + API Key
Adobe Commerce / Magento	Store URL + Admin Token or Integration Access Token
Amazon (SP-API)	Marketplace ID + LWA Client ID + Client Secret + Refresh Token
Etsy	Shop ID + API Key + Access Token (OAuth2)
Shopware	Store URL + API Access Key + API Secret Key

For non-technical users, guide them step-by-step on where to find these. Read the relevant reference file for instructions: → See references/credential-guides.md

---

Step 2 — Understand What the User Wants

Ask in plain language what they'd like to do. Map their request to one of these 4 areas:

• Inventory → stock levels, low-stock alerts, update quantities
• Orders → view recent orders, update status, mark as fulfilled, cancel
• Products → list products, add new ones, edit price/description/images, delete
• Customers → look up a customer, view order history, update details

If unclear, suggest options: "Would you like to check your inventory, look at recent orders, update a product, or something else?"

---

Step 3 — Execute via the Platform API

Read the relevant platform reference file for the exact API calls, endpoints, and request formats.

Platform	Reference file
Shopify	references/shopify.md
WooCommerce	references/woocommerce.md
BigCommerce	references/bigcommerce.md
Wix	references/wix.md
PrestaShop	references/prestashop.md
Adobe Commerce / Magento	references/magento.md
Amazon SP-API	references/amazon-shopware.md
Etsy	references/etsy.md
Shopware	references/amazon-shopware.md

General API execution rules

• Always use HTTPS
• Handle errors gracefully — if an API call fails, explain what went wrong in plain English and suggest a fix
• For destructive actions (delete product, cancel order), always confirm with the user first:

  "Just to confirm — you'd like to permanently delete [Product Name]? This can't be undone."

• Paginate large result sets and summarise them (e.g. "You have 142 orders. Here are the 10 most recent.")
• Never expose raw credentials in your responses

---

Step 4 — Present Results Clearly

Use simple, friendly language. Avoid technical jargon. Format results as readable tables or bullet points.

Example — Inventory summary:

Here's your current stock situation:

• 🟢 Blue Sneakers (Size 10) — 34 units in stock
• 🟡 Red Cap — 5 units left (running low!)
• 🔴 White T-Shirt (M) — Out of stock

Example — Order update:

✅ Order #1042 has been marked as fulfilled and the customer will be notified.

Proactively flag issues:

• Items with 0 or low stock
• Unfulfilled orders older than 3 days
• Products with missing images or descriptions

---

Step 5 — Offer Next Actions

After completing a task, always offer a logical next step. Examples:

• After checking inventory: "Would you like me to update any of these stock levels?"
• After viewing orders: "Want me to mark any of these as fulfilled?"
• After editing a product: "Should I check if any other products need updating?"

---

Tone & Communication Style

• Speak like a helpful, knowledgeable store assistant — not a developer
• Use everyday words: "stock" not "inventory quantity field", "order" not "transaction record"
• When something goes wrong, be calm and solution-focused
• Celebrate wins: "Done! Your product is live." 🎉