by 安全扫描
OpenClaw
安全
high confidenceThe skill's files and runtime instructions match its stated purpose (generating PR/press strategies for Shopify stores); it is an instruction-only skill with a small Bash wrapper that invokes the OpenClaw agent and does not request credentials or perform surprising actions.
评估建议
This skill is coherent and low-risk for its stated purpose, but review and follow these precautions before use: 1) Inspect analyze.sh (you already have it) and confirm it matches the prompt you expect; it simply calls 'openclaw agent' with your input. 2) Do not include secrets, API keys, or private customer data in the prompt—those would be sent to the model/backend the OpenClaw CLI uses. 3) Verify the 'openclaw' CLI on your system is configured to use a trusted local model or trusted provider; ...详细分析 ▾
✓ 用途与能力
The name/description promise a PR & press strategy and the SKILL.md plus analyze.sh produce a prompt to generate that content. There are no unrelated environment variables, binaries, or config paths requested.
ℹ 指令范围
The SKILL.md and analyze.sh are narrowly scoped to building a PR strategy. The analyze.sh takes user input and calls 'openclaw agent --local --message ...' to generate the report. It does not read other files or environment variables. Caveat: calling the OpenClaw agent will transmit the user-provided prompt (store niche/URL and any text you pass) to whatever model/backend the agent is configured to use—this may be a remote service depending on your local configuration, so user-provided sensitive data could be exposed.
✓ 安装机制
No install spec or downloads. The only runtime requirement is an available 'openclaw' CLI (invoked by the included shell script). No archives, package installs, or remote code downloads are performed by the skill itself.
✓ 凭证需求
The skill declares no required environment variables or credentials and the code does not reference secrets or unrelated env vars. The amount of access requested is proportionate to generating PR content.
✓ 持久化与权限
always is false and the skill does not request permanent presence or modify other skills or agent-wide settings. The script creates a short-lived session ID for the single run only.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/27
- Initial release of shopify-pr-strategy skill. - Provides a complete PR and media outreach strategy specifically for Shopify merchants. - Generates story angles, media target lists, pitch and press release templates, and guides on building journalist relationships. - Includes methods for proactive and reactive PR, plus tips for measuring media coverage impact.
● 无害
安装命令
点击复制官方npx clawhub@latest install shopify-pr-strategy
镜像加速npx clawhub@latest install shopify-pr-strategy --registry https://cn.longxiaskill.com镜像同步中