← Back to Skills Marketplace
Orderflow
by
ncreighton
· GitHub ↗
· v1.0.0
· MIT-0
118
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install orderflow
Description
Automate order routing, fulfillment, and inventory management across channels. Use when the user needs real-time order processing, multi-warehouse routing, o...
Usage Guidance
Before installing, get answers to these questions from the skill author or maintainer: (1) Provide a complete list of all credentials the skill will ever ask for (Google API creds, Twilio, SendGrid, ShipStation, 3PLs, etc.) and whether any are optional. (2) Confirm the minimum scope for WAREHOUSE_API_TOKEN and SHOPIFY credentials (read-only vs. read/write; restrict to test/staging when possible). (3) Explain where order/customer data is sent (exact domains/webhooks/Google Sheets accounts) and retention/PII handling policies. (4) Ask for examples of the exact commands or API calls the agent will perform (so you can audit for data exfiltration). (5) Test in a staging environment with limited-scope tokens before granting production credentials. Finally, treat the Slack webhook as a potential exfiltration channel — only provide a webhook you control and that is scoped to an appropriate channel.
Capability Analysis
Type: OpenClaw Skill
Name: orderflow
Version: 1.0.0
The skill bundle requests a wide array of highly sensitive environment variables (Shopify, Slack, Warehouse, SendGrid, etc.) and instructs the agent to install and execute an unverified global NPM package (`orderflow-cli`) in SKILL.md. It also promotes insecure practices by suggesting that credentials be passed as command-line arguments during the authentication step. While the stated goal of e-commerce automation is plausible, the requirement for external binary execution and the broad access to high-value secrets without a verified provenance for the CLI tool present a significant security risk.
Capability Assessment
Purpose & Capability
Requested binaries (curl, node) and required env vars (SHOPIFY_API_KEY, SHOPIFY_API_PASSWORD, WAREHOUSE_API_TOKEN, SLACK_WEBHOOK_URL) are consistent with an order-routing/automation skill. However, the SKILL.md advertises many other integrations (Google Sheets, Twilio SMS, SendGrid, ShipStation, multiple 3PLs and carriers) whose credentials are not declared in requires.env. That mismatch suggests either omissions in the manifest or that the skill will ask for or expect additional secrets at runtime — an incoherence worth clarifying.
Instruction Scope
SKILL.md is an instruction-only runtime spec that directs the agent to sync inventory, route orders, generate shipping labels, send Slack messages, create Google Sheets POs, and send SMS/email. Those actions involve reading and transmitting sensitive order/customer/inventory data to multiple external endpoints. The instructions as provided are broad and grant the agent wide discretion (scheduling periodic syncs, exception handling, auto-fulfill), but they don't enumerate how credentials for the non-declared integrations will be supplied, nor do they constrain what data fields may be shared externally. That openness increases the risk of unintended data exposure or overbroad access.
Install Mechanism
No install spec and no code files—this is instruction-only. That's lower risk from an installation/executable perspective because nothing is dropped to disk by an installer. The runtime will rely on available system binaries (curl, node).
Credentials
The four declared env vars are sensitive but reasonable for core Shopify->warehouse->Slack operation. Concerns: (1) WAREHOUSE_API_TOKEN is opaque and could grant broad access to internal warehouse systems — it should be scoped and limited. (2) Many additional integrations mentioned in the docs (Google Sheets, Twilio, SendGrid, ShipStation, etc.) are not reflected in requires.env, so it's unclear how their credentials are handled. Requiring fewer, narrowly-scoped credentials is preferable; as-is, credential handling is underspecified.
Persistence & Privilege
always is false and there is no install-time modification of other skills or system-wide settings documented. The skill can be invoked autonomously (default), which is normal for skills; this combined with broad/incomplete credential declarations increases risk, but autonomous invocation itself is not a reason to block.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install orderflow - After installation, invoke the skill by name or use
/orderflow - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
OrderFlow 1.0.0 initial release.
- Introduces intelligent e-commerce order management workflows for multi-channel fulfillment.
- Enables real-time order routing, inventory sync, and exception handling across multiple warehouses and platforms.
- Integrates with Shopify, WooCommerce, Slack, Google Sheets, ShipStation, and more.
- Provides customizable rule-based workflows, real-time alerts, and inventory orchestration.
- Supports automated reporting, analytics, and multi-condition fulfillment logic.
Metadata
Frequently Asked Questions
What is Orderflow?
Automate order routing, fulfillment, and inventory management across channels. Use when the user needs real-time order processing, multi-warehouse routing, o... It is an AI Agent Skill for Claude Code / OpenClaw, with 118 downloads so far.
How do I install Orderflow?
Run "/install orderflow" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Orderflow free?
Yes, Orderflow is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Orderflow support?
Orderflow is cross-platform and runs anywhere OpenClaw / Claude Code is available (macos, linux, win32).
Who created Orderflow?
It is built and maintained by ncreighton (@ncreighton); the current version is v1.0.0.
More Skills