by 安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This skill appears to do what it claims (generate a Shopify localization strategy), but before running it: 1) Verify you have a trusted 'openclaw agent' CLI installed — the script calls it but the skill metadata fails to declare that dependency. 2) Understand that running analyze.sh launches your local agent which may read model/API keys or connectors from your environment (e.g., OPENAI_API_KEY or other agent config) — run in an environment you control. 3) Inspect the openclaw agent binary you w...详细分析 ▾
ℹ 用途与能力
The SKILL.md and analyze.sh both implement a Shopify localization playbook and produce the expected outputs (translation workflow, payment methods, SEO, etc.). However the package metadata declares no required binaries while analyze.sh calls the 'openclaw agent' CLI — the skill implicitly requires that binary but does not declare it. This mismatch is likely an oversight but is an incoherence the user should be aware of.
ℹ 指令范围
The runtime script only constructs a localization prompt and invokes a local 'openclaw agent' process; it does not read arbitrary local files or request unrelated system paths or credentials. That scope is consistent with the declared purpose. The main scope concern is that invoking a local agent hands control to another program (and possibly to networked model APIs), which could in turn access connectors or other skills — the SKILL.md does not document that behavior.
✓ 安装机制
There is no install spec and only a small shell script is included. No archives are downloaded and nothing is written to disk by an installer step; this is low-risk from an install-mechanism perspective.
ℹ 凭证需求
The skill declares no environment variables or credentials. However, analyze.sh calls 'openclaw agent --local', which will run whatever local OpenClaw client is installed; that client may read model/API keys or connector credentials from your environment or agent config. The skill does not declare or warn about this implicit dependency on the user's model/API configuration.
✓ 持久化与权限
The skill does not request persistent installation or elevated privileges. Flags show always:false and default autonomy settings; there is no evidence the skill modifies other skills or system-wide agent settings.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/27
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install shopify-localization
镜像加速npx clawhub@latest install shopify-localization --registry https://cn.longxiaskill.com