Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

shopyo

v1.0.0

Modular Flask framework for building scalable, maintainable web apps with isolated modules, event-driven communication, CLI tools, and built-in auth and data...

0· 190·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for abdur-rahmaanj/shopyo.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "shopyo" (abdur-rahmaanj/shopyo) from ClawHub.
Skill page: https://clawhub.ai/abdur-rahmaanj/shopyo
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install shopyo

ClawHub CLI

Package manager switcher

npx clawhub@latest install shopyo
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The SKILL.md documents a modular Flask framework and CLI usage (shopyo, flask, DB commands). However the skill metadata lists no source or homepage and declares no required binaries or env vars. For a CLI-oriented framework, one would expect at least 'shopyo'/'flask' as required binaries or an install instruction or a trusted source — their absence is inconsistent.
!
Instruction Scope
The instructions tell the agent/user to run commands that modify the filesystem and local DB (shopyo initialise, db migrate/upgrade, clean, collectstatic). They also instruct setting env vars (SHOPYO_CONFIG_PROFILE, FLASK_ENV, FLASK_APP) that are not declared in metadata. While these actions are normal for a web framework, the skill grants no explicit constraints and the metadata omits these runtime expectations.
Install Mechanism
No install spec and no code files are present, so the skill is instruction-only and does not install anything itself. This lowers direct install risk, but also means the SKILL.md assumes external tools are already installed from elsewhere.
!
Credentials
The metadata declares no required environment or credentials, yet the instructions reference several environment variables to control behavior. The doc also documents a default admin email/password after initialization (admin@domain.com / pass) — useful for dev but insecure if used inadvertently in a non-isolated environment.
Persistence & Privilege
The skill does not request persistent presence (always:false) and does not modify other skills or system-wide settings. Autonomous model invocation is allowed by default but is not accompanied by extra privileges here.
What to consider before installing
This SKILL.md is effectively documentation for using the Shopyo CLI and framework rather than an installer. Before using/installing anything: (1) verify the official Shopyo project source or homepage and install the shopyo/flask packages from a trusted repository, (2) do not run 'shopyo initialise', 'clean', or DB migration commands on production data — they modify/reset databases and files, (3) change the documented default admin password if you initialize a site, (4) be aware the skill metadata does not declare the required binaries or env vars (SHOPYO_CONFIG_PROFILE, FLASK_ENV, FLASK_APP), so expect to manually provide/install them, and (5) if you expect an integrated skill (auto-install), treat this as purely documentation — request a version that includes a verified install spec or source URL before granting privileges or running commands.

Like a lobster shell, security has layers — review code before you run it.

latestvk97fz8gr85nj5f18tyqwnx6vsd837g78
190downloads
0stars
1versions
Updated 22h ago
v1.0.0
MIT-0

Shopyo Skill

Shopyo is a modular Flask framework designed for maintainability, extensibility, and real-world scale.

Project Structure

A typical Shopyo project:

/project_root
├── app.py          # Entry point, defines create_app()
├── init.py         # Extension initializer (db, login_manager, etc.)
├── manage.py       # CLI entry point
├── config.py       # Profile-based configuration
└── modules/        # Modular code
    ├── box__default/
    │   ├── auth/
    │   └── settings/
    └── my_custom_module/

CLI Commands

# Environment setup
export SHOPYO_CONFIG_PROFILE=development
export FLASK_ENV=development
export FLASK_APP=app.py

# New project
shopyo new myproject --demo
cd myproject
shopyo initialise

# Create module
shopyo startapp modulename [boxname]

# Create box
shopyo startbox box__name

# Run server
shopyo run
flask run --debug

# Database
shopyo initialise   # Fresh start (creates db, migrations, default users)
shopyo db migrate
shopyo db upgrade
shopyo clean        # Reset local database

# Static files
shopyo collectstatic [module_path]  # Collect static files from modules

# Other
shopyo routes       # Show all routes
shopyo audit        # Find project issues
shopyo rename old_name new_name  # Rename module

Creating a Module

shopyo startapp blog
# or with box
shopyo startapp blog box__ecommerce

Creates:

modules/blog/
├── __init__.py
├── forms.py
├── global.py
├── info.json
├── models.py
├── view.py
├── static/
├── templates/
│   └── blog/
│       ├── blocks/
│       │   └── sidebar.html
│       ├── dashboard.html
│       └── index.html
└── tests/
    ├── test_blog_functional.py
    └── test_blog_models.py

info.json Structure

{
   "author": {"mail": "", "name": "", "website": ""},
   "display_string": "Page",
   "module_name": "page",
   "type": "show",
   "fa-icon": "fa fa-store",
   "url_prefix": "/page",
   "dashboard": "/dashboard"
}

Module View Pattern

from shopyo.api.module import ModuleHelp

mhelp = ModuleHelp(__file__, __name__)
blueprint = mhelp.blueprint

@blueprint.route("/")
def index():
    context = mhelp.context()
    context.update({'message': 'Hello'})
    return mhelp.render('index.html', **context)

Models Pattern

from init import db
from shopyo.api.models import PkModel

class MyModel(PkModel):
    __tablename__ = 'mymodel'
    name = db.Column(db.String(100))

Templates

Extend the base template:

{% extends "shopyo_base/main_base.html" %}
{% block content %}
<h1>Hello</h1>
{% endblock %}

Use yo_render:

from shopyo.api.templates import yo_render

@blueprint.route("/demo")
def demo():
    return yo_render('blog/demo.html', {'key': 'value'})

Shopyo API

Key imports:

from shopyo.api.module import ModuleHelp, get_module, dispatch
from shopyo.api.models import PkModel
from shopyo.api.templates import yo_render
from shopyo.api.database import db
from shopyo.api.enhance import enhance_html

Inter-Module Communication

Use the event system:

from shopyo.api.module import dispatch

# Dispatch event
dispatch("user:registered", {"email": user.email})

# Listen for event
@dispatch("user:registered")
def send_welcome_email(email):
    pass

Testing

pytest
pytest -v
pytest path/to/test.py
pytest --cov=shopyo
tox

Global.py Pattern

available_everywhere = {"x": 1}

configs = {
    "development": {"CONFIG_VAR": "DEVVALUE"},
    "production": {"CONFIG_VAR": "PRODVALUE"},
    "testing": {"CONFIG_VAR": "TESTVALUE"}
}

Default Credentials

After shopyo initialise:

Key Conventions

  • Box folders must start with box__
  • Modules are isolated - do not import between modules directly
  • Use event system (dispatch) for inter-module communication
  • Run shopyo initialise after adding/removing modules
  • Static files are collected into static/modules/ - don't edit directly
  • Use shopyo clean to reset local development database

Comments

Loading comments...