Shopify Admin API
Security checks across malware telemetry and agentic risk
Overview
This skill is a coherent Shopify admin reference, but it asks for broad store-admin access and documents destructive store operations without clear guardrails or metadata disclosure.
Install only if you intentionally want the agent to administer a Shopify store. Create a dedicated Shopify custom app token with the minimum scopes needed, avoid broad historical-order access unless required, and require manual confirmation before any write, delete, cancellation, refund, fulfillment, inventory, or customer-data action.
VirusTotal
65/65 vendors flagged this skill as clean.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If used incorrectly or by an untrusted agent, the token could expose customer/order data or allow major changes to the store.
The skill asks for a privileged Shopify Admin API token with broad access to store, customer, order, and inventory data, including write scopes and older-order access.
`SHOPIFY_ACCESS_TOKEN` - Admin API access token from custom app ... `read_orders` / `write_orders`, `read_products` / `write_products`, `read_customers` / `write_customers`, `read_inventory` / `write_inventory`, `read_returns` / `write_returns`, `read_all_orders`
Use the least-privileged custom app token possible, avoid `read_all_orders` unless truly needed, and install only for agents you trust to handle Shopify admin access.
A mistaken or overly autonomous action could cancel real orders, remove products, alter listings, or otherwise disrupt store operations.
The API reference includes examples for destructive or high-impact Shopify actions such as canceling orders and deleting products, without explicit approval, confirmation, or rollback guidance.
#### Cancel Order ... `-X POST` ... `{"reason":"customer","email":true,"restock":true}` ... #### Delete Product ... `-X DELETE`Require explicit user confirmation before any write, cancel, refund, fulfillment, inventory, or delete action, and test first with limited scopes or a development store.
Users may not see the credential requirement or provenance limitations from the registry metadata alone.
The registry metadata provides no source or homepage and does not declare the Shopify environment variables or Admin API token that SKILL.md requires.
Source: unknown Homepage: none Required env vars: none Primary credential: none
Treat this as an unverified instruction-only skill and review the SKILL.md setup carefully before providing any Shopify token.