Shopify Expert

Enable Shopify superpowers for OpenClaw. Get a massive boost in knowledge about everything related to Shopify in general and Shopify development.

Security Scan

The skill's requirements and instructions match its stated purpose (Shopify reference/assistant guidance); it is an instruction-only bundle that does not request unrelated credentials or install arbitrary code.

Purpose & Capability

Name/description (Shopify guidance + references) align with what is included: a snapshot of shopify.dev docs and advice for using the Admin APIs. The single required env var (SHOPIFY_SHOP_DOMAIN) and optional use of curl are coherent with the stated purpose.

Instruction Scope

SKILL.md limits runtime behavior to using bundled references and calling Shopify over HTTPS (curl or similar). It instructs the agent to confirm shop context, API version, and scopes before writes, and explicitly warns not to echo secrets. The instructions do not ask the agent to read unrelated system files or collect data outside Shopify context.

Install Mechanism

Instruction-only skill with no install spec and no code files — nothing is written to disk by the skill itself. This is the lowest-risk install model.

Credentials

Only SHOPIFY_SHOP_DOMAIN is required for eligibility, which is proportionate. The docs reference conventional tokens (e.g., SHOPIFY_ADMIN_API_ACCESS_TOKEN) for real API calls — those are not required by the skill but if you supply them and allow curl, the agent can make authenticated calls. Treat providing access tokens or broad network access as a risk decision.

Persistence & Privilege

always is false and the skill does not request any elevated platform privileges or modify other skills/config. Autonomous invocation is allowed by default (normal for skills) but not combined with other concerning flags.

Assessment

This skill is largely a bundled snapshot of Shopify developer docs and guidance — it appears internally coherent. Main things to consider before installing: - Provide only the minimal environment/config the skill needs for eligibility (SHOPIFY_SHOP_DOMAIN). Do not store admin access tokens in plaintext or paste them in chat. Use the platform's secret store for tokens. - If you supply an Admin API access token and allow outbound HTTP (curl), the agent can make authenticated API calls that modify production data. Require human approval or limit scopes when performing write operations. - The bundled docs are a point-in-time snapshot; verify payloads, API versions, and scopes against live shopify.dev for accuracy before relying on examples for production changes. - If you need stricter controls, restrict the agent's network access to only the specific Shopify hosts and require explicit user confirmation for any destructive or bulk operations.

Instructions in this file are plain Markdown (no hidden or encoded content).

Bundle version: 1.1.0

Shopify Expert: User Guide

What this skill is

This skill gives your OpenClaw agent structured guidance and bundled excerpts from Shopify official LLM documentation snapshot (regenerated into references/DOC_*.md), plus a hand-curated Admin REST API reference (references/ADMIN_REST_API.md). It covers apps, GraphQL Admin API, REST Admin JSON endpoints, CLI, Polaris, checkout / admin / customer account / POS extensions, Functions, webhooks, metafields, Liquid, themes, Hydrogen / headless, and deployment — at a point in time; always verify against live shopify.dev for your API version.

Not exhaustive: the bundle is not a full mirror of Shopify docs or every changelog. Treat it as entry points + checklists.

Intended role: Knowledge and routing — orient the agent, pick the smallest relevant references/ file, and use bundled text as a starting point. This skill is not a complete offline substitute for shopify.dev; when payloads, fields, or versioning must be exact, use live developer docs (or web tools your gateway allows).

The AI usually talks to Shopify over HTTPS (curl or similar). Broader gateway tools follow your host policy; see {baseDir}/references/OPENCLAW_INTEGRATION.md and {baseDir}/references/SAFETY.md.

No companion plugin (v1)

There is no OpenClaw plugin in v1 — only this skill and optional curl. Prefer documented Admin GraphQL (DOC_ADMIN_API.md), REST (ADMIN_REST_API.md), and CLI patterns; see {baseDir}/references/TOOLING.md and {baseDir}/references/AUTH.md.

Installation (typical)

1. Install the skill (ClawHub or skills/shopify-expert on the gateway host).
2. Set SHOPIFY_SHOP_DOMAIN (e.g. your-store.myshopify.com — see {baseDir}/references/AUTH.md).
3. Allow curl (and other tools only if your policy permits).
4. Restart the gateway after skill or env changes if needed.

Details: {baseDir}/README.md, {baseDir}/references/CONNECTING.md, {baseDir}/references/AUTH.md.

What you can expect from the AI

• Use live shopify.dev when API shape, versions, or compliance matter.
• Confirm the shop context, API version, and access scopes before writes.
• No secrets in chat — env and secret stores only; see {baseDir}/references/AUTH.md.

Required setup (eligibility)

Per metadata.openclaw.requires:

1. SHOPIFY_SHOP_DOMAIN — Admin / API host suffix, e.g. example.myshopify.com (no https://, no trailing path).

Optional for real API calls: access token and API version — see {baseDir}/references/AUTH.md.

When the agent should use this skill

Use for Shopify development: apps, extensions, Storefront API, Liquid/themes, Hydrogen, webhooks, Functions, metafields, deployment.

Load {baseDir}/references/OVERVIEW.md first, then the smallest matching DOC_*.md, ADMIN_REST_API.md (REST), or other hand-authored file.

Rules for the assistant (summary)

1. Version and context first — shop domain, API version, app type (public/custom), and scopes.
2. Prefer official GraphQL Admin API, REST Admin API where applicable, and CLI docs over guessing payloads.
3. Never echo tokens; reference env names only.
4. After tool or env changes, gateway restart may be required.

Where work runs: on the OpenClaw gateway (HTTP to Shopify), not inside Shopify’s runtime unless the user’s setup allows it.