Shopify Directory

Discover Shopify merchants by category or store name through Lobster Stores. Use when a buyer wants help finding the right merchant for coffee, cookies, supp...

This skill is internally consistent and doesn't ask for secrets or install code, but it delegates behavior to external skill.md files on the listed Lobster domains. Before installing, consider whether you trust those domains and the platform's safeguards: remote skill.md content can change and could instruct the agent to perform actions you wouldn't expect. Recommended mitigations: (1) restrict the agent from fetching arbitrary external instructions or require user approval before following external instructions; (2) review the actual content of the listed category skill.md pages to ensure they don't request credentials or ask the agent to transmit user data; (3) ensure the agent never collects payment details in-chat and always hands checkout to the merchant's native Shopify checkout as instructed. If you need higher assurance, request that the skill be converted to a static directory (embedded data) or that the platform sandbox/whitelist remote skill.md sources.

Type: OpenClaw Skill Name: shopify-directory Version: 1.0.0 The skill acts as a directory that instructs the agent to fetch and follow instructions from external URLs (e.g., lobsterbrew.com/skill.md). While this behavior is aligned with the stated purpose of merchant discovery, the instruction to treat external, dynamically fetched content as the 'source of truth' creates a significant risk for indirect prompt injection. The skill explicitly advises against collecting payment information, suggesting no immediate malicious intent, but the architectural pattern of fetching remote instructions is inherently risky.