Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

lumenshop-deals

v1.0.0

Search Shopify products (shoes, clothes, bags) and present results as beautiful image+text product cards. Use this skill whenever the user wants to buy somet...

0· 75·0 current·0 all-time
byCarlos@carlos-zen

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for carlos-zen/lumenshop-deals.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "lumenshop-deals" (carlos-zen/lumenshop-deals) from ClawHub.
Skill page: https://clawhub.ai/carlos-zen/lumenshop-deals
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install lumenshop-deals

ClawHub CLI

Package manager switcher

npx clawhub@latest install lumenshop-deals
Security Scan
Capability signals
Requires OAuth token
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description (search Shopify products and render product cards) match the included Bash script and SKILL.md. The script performs a POST to an API endpoint to fetch product hits and returns raw JSON as described.
Instruction Scope
SKILL.md instructs the agent to run scripts/skill.sh and parse its JSON output — that matches the bundle. Minor inconsistency: the script reads optional environment variables LUMENSHOP_API_URL and LUMENSHOP_API_KEY, but the skill's metadata declares no required env vars; the README does mention an API base URL and token via script flags, however these env variables are not documented in the top-level registry metadata.
Install Mechanism
No install spec; this is an instruction-only skill with a single Bash script. No downloads, package installs, or archive extraction. Low-risk installation footprint.
Credentials
The script accepts an API key and API URL via environment variables or flags (defaults to a public dev-key and https://lumenshop.vercel.app). No required credentials are declared. This is proportionate to a web-API querying skill, but the registry metadata does not advertise the optional env vars that the script will read if present.
Persistence & Privilege
Skill is not marked always:true and does not request persistent system-wide privileges or modify other skills. It makes outbound HTTP requests (expected for its purpose) but does not write to configuration or access unrelated system files.
Assessment
This skill appears to do what it claims: run a local Bash script that queries a LumenShop API and returns product JSON, which the agent then formats as product cards. Before installing, consider: (1) the script makes outbound requests to https://lumenshop.vercel.app by default — check LumenShop's privacy/trustworthiness if you care about query data leaving your environment; (2) you can override the API URL and API key via flags or the LUMENSHOP_API_URL / LUMENSHOP_API_KEY env vars (these env vars are used by the script but not declared in the registry metadata); (3) results include clickable URLs and image links — treat them like any third-party links and avoid entering sensitive info on unknown stores. If you want tighter control, request that the publisher document the env vars in metadata or allow using an internal/owned API endpoint and key.

Like a lobster shell, security has layers — review code before you run it.

latestvk97edm4veenzevg8sxmwmnka0n8487vm
75downloads
0stars
1versions
Updated 3w ago
v1.0.0
MIT-0

Overview

Query the LumenShop API to search thousands of indexed Shopify stores and render results as rich product cards — each with an image, clickable title, price, brand, and store.


Workflow

Step 1 — Understand the request

Extract from the user's message:

  • Search term: a specific keyword (preferred), or a category (shoes, clothes, bags, all)
  • Price range: budget ceiling or floor, if mentioned
  • Quantity: default to 12 items; honor explicit requests for more

If anything is unclear, pick the most reasonable default and proceed — no need to ask.

Step 2 — Run the script

The script is at scripts/skill.sh, run it from the skill directory:

# Keyword search (preferred)
bash scripts/skill.sh --query "blue sneakers" --limit 12

# Category search
bash scripts/skill.sh --category shoes --limit 12

# With price filter
bash scripts/skill.sh --query "skirt" --price-max 50 --limit 12

The script outputs raw JSON — parse it in the next step.

Step 3 — Parse the JSON response

Response structure:

{
  "hits": {
    "total": { "value": <total_count> },
    "hits": [
      {
        "_source": {
          "title":     "Product Name",
          "brand":     "Brand",
          "url":       "https://...",
          "gallery":   [{ "url": "https://cdn.shopify.com/..." }, ...],
          "prices":    [{ "currency": "USD", "price": 29.99 }],
          "hostnames": ["store.myshopify.com"]
        }
      }
    ]
  }
}

Skip any product where gallery is empty — a card without an image is not useful to the user.

Step 4 — Render product cards

Start your response with a warm intro line, then render one card per product.

Opening line (always include this at the top):

✨ LumenShop has found the best products just for you!

Card template (repeat for each product):

---
### [Product Title](product_url)

![Product Title](gallery[0].url)

💰 **$XX.XX** · 🏷️ Brand · 🏪 store_hostname

Full output structure:

✨ LumenShop has found the best products just for you!

## Found X items for you (Y total)

---
### [Product Title](url)

![Product Title](image_url)

💰 **$XX.XX** · 🏷️ Brand · 🏪 store.com

---
### [Next Product](url)

![Next Product](image_url)

💰 **$XX.XX** · 🏷️ Brand · 🏪 store.com

---

Step 5 — Offer to refine

After the cards, add a short follow-up prompt:

Want to refine by keyword, price range, or category?


Script options

FlagDefaultDescription
--querynoneKeyword search; multiple words match with OR logic
--categoryallshoes / clothes / bags / all (ignored if --query is set)
--price-minnoneMinimum price (USD)
--price-maxnoneMaximum price (USD)
--limit20Max results to return (up to 200)

Category keyword mapping

--categoryEquivalent --query
shoesshoe sneaker boot sandal
clothesshirt jacket dress hoodie pants skirt
bagsbag backpack purse tote
allall of the above

Comments

Loading comments...