by 安全扫描
OpenClaw
可疑
medium confidenceThe skill mostly does what its description says (generate a Shopify launch playbook), but the included shell script invokes a local 'openclaw' CLI that is not declared as a required binary and could change where prompts are sent — this mismatch and implicit dependency warrant caution.
评估建议
This skill appears coherent for generating a Shopify launch playbook, but exercise caution before running the included script. The analyze.sh script invokes an 'openclaw' CLI that is not declared in the manifest — confirm whether that binary exists on your system, where it came from, and what network activity it performs. Inspect the openclaw CLI (or run the script in an isolated/sandbox environment) to ensure prompts are not sent to an unexpected remote endpoint. If you don't want the skill to ...详细分析 ▾
ℹ 用途与能力
The name/description (Shopify launch playbook) matches the skill files: SKILL.md describes the deliverables and analyze.sh builds a prompt to produce that content. However, analyze.sh invokes an 'openclaw' CLI to generate the output even though the manifest lists no required binaries. Requiring a local agent binary to produce the content is plausible but the binary is not declared, which is an incoherence (missing declared dependency).
✓ 指令范围
SKILL.md and analyze.sh stay within the stated purpose: they construct a detailed prompt for a product launch playbook and do not read or send any local files, environment variables, or unrelated system data. The only runtime action beyond local shell work is calling the 'openclaw' CLI with the prompt, which is consistent with generating model output but may forward the prompt externally depending on that CLI's behavior.
✓ 安装机制
There is no install spec and no downloads — this is an instruction-only skill with a single helper script. That's low-risk from an installation perspective. The script will be written to disk when the skill is installed (it already exists in the bundle) but nothing in the manifest will automatically fetch remote code.
✓ 凭证需求
The skill declares no required environment variables or credentials and the script does not reference env vars or config paths. That aligns with a content-generation playbook. Note: the allowed-tools is Bash, which permits arbitrary shell commands if the agent runs the script, so the runtime environment in which you execute analyze.sh matters.
✓ 持久化与权限
The skill is not set to always:true and does not request elevated or persistent system presence. Model invocation is enabled (default), which is normal for skills. There is no evidence the skill modifies other skills or system-wide agent settings.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/27
- Initial release of shopify-launch-strategy skill. - Provides a comprehensive product launch playbook for Shopify merchants. - Generates tailored 30-60-90 day launch roadmaps including pre-launch, launch day, and post-launch strategies. - Delivers email sequences, social media calendars, paid ad plans, and influencer activation. - Designed for easy usage with product and niche prompts.
● 可疑
安装命令
点击复制官方npx clawhub@latest install shopify-launch-strategy
镜像加速npx clawhub@latest install shopify-launch-strategy --registry https://cn.longxiaskill.com