Shopify Content Marketing

Build a content marketing and SEO blog strategy for Shopify stores to drive organic traffic, build authority, and convert readers to buyers. Triggers: conten...

This skill appears to do what it says (generate Shopify content/SEO strategies), but the bundled analyze.sh calls the 'openclaw' CLI tool even though the skill metadata doesn't declare that requirement. Before installing or running: 1) Verify you have the openclaw CLI installed and understand what it will do locally (does it call remote services, send telemetry, or read local config?). 2) Inspect the repository origin (the GitHub homepage) and confirm trust in the maintainer. 3) Run the script in a safe environment (isolated VM or container) to observe network activity and CLI behavior. 4) Avoid passing any sensitive store credentials or secrets as the INPUT to the script, since the script sends the prompt to the OpenClaw agent which may use local config or networked backends. If you plan to use this skill in production, request that the author declare the openclaw binary requirement (or provide a pure-instruction implementation) and explain what the local agent invocation does.

Type: OpenClaw Skill Name: shopify-content-marketing Version: 1.0.0 The skill bundle contains a shell injection vulnerability in `analyze.sh` because it embeds unsanitized user input (`${INPUT}`) directly into a double-quoted string (`PROMPT`). This allows for arbitrary command execution on the host system if the input contains command substitution patterns like `$(...)`. While the overall content and the detailed marketing prompt appear legitimate and aligned with the stated purpose, the lack of input sanitization in a script intended for execution by an AI agent constitutes a high-risk security flaw.