← Back to Skills Marketplace
179
Downloads
0
Stars
0
Active Installs
12
Versions
Install in OpenClaw
/install openclaw-shopify-manager
Description
Connect OpenClaw to Shopify with guided setup, local `.env` secret storage, Shopify OAuth, webhook validation, product and content operations, and host or Do...
Usage Guidance
This skill appears to do what it says: run a local Shopify connector, perform OAuth, validate HMACs, and call Shopify Admin APIs while storing secrets in a local .env. Before installing: (1) only provide the Shopify API key/secret to the guided setup and keep the runtime directory under your control; (2) inspect the provided service template and scripts if you plan to install systemd, and install the service manually (the skill does not auto-install); (3) run the connector locally first and verify health and OAuth flows before exposing any public URL; (4) if you use Tailscale, install/configure it yourself — the skill only documents usage and does not bundle any tunneling binaries; (5) be cautious with mutation commands (update/create) and confirm changes before proceeding. If you want additional assurance, review the full shopify-connector.mjs and setup-runtime.mjs files to confirm logging behavior and where token files are written.
Capability Analysis
Type: OpenClaw Skill
Name: openclaw-shopify-manager
Version: 0.2.1
The OpenClaw Shopify Manager skill is a well-architected tool for managing Shopify stores with a strong emphasis on security and local control. It implements a local connector server (scripts/shopify-connector.mjs) using native Node.js modules to handle OAuth flows and webhooks, featuring robust HMAC validation and local secret storage in .env files. The setup process (scripts/setup-runtime.mjs) includes a 'doctor' mode to verify configuration integrity and ensures sensitive files are protected via .gitignore. No evidence of data exfiltration, malicious execution, or prompt injection was found; the skill explicitly defaults to read-only operations and requires user confirmation for mutations as outlined in SKILL.md and references/security-and-behavior.md.
Capability Assessment
Purpose & Capability
Name/description (Shopify connector) align with the files and envs. Required env vars (SHOPIFY_API_KEY, SHOPIFY_API_SECRET, SHOPIFY_SHOP, SHOPIFY_REDIRECT_URI) match Shopify usage. Bundled scripts and docs all relate to bootstrapping a local connector, OAuth, webhooks, Tailscale guidance, and optional systemd deployment — nothing extraneous (e.g., cloud provider credentials) is requested.
Instruction Scope
SKILL.md and the referenced scripts instruct the agent to create a local runtime, write a local .env, run a small HTTP server, validate HMACs, and call Shopify APIs. They reference only local paths, systemd templates, and operator-managed ingress (Tailscale or reverse proxy). There is no instruction to read unrelated host files, exfiltrate secrets, or call unexpected third-party endpoints.
Install Mechanism
No remote install or download steps are bundled; it is instruction- and script-based (no installer fetching remote archives). The skill ships scripts and templates to be run locally by the operator. This is the low-risk pattern described in the policy.
Credentials
Requested environment variables are the standard Shopify app credentials and redirect info. The code does use optional runtime path env vars (SHOPIFY_RUNTIME_ROOT, SHOPIFY_ENV_PATH, etc.) for flexibility, but those are operational (not additional secrets). SHOPIFY_ACCESS_TOKEN is produced by OAuth and not required up-front.
Persistence & Privilege
The skill persists config, .env, state, and logs under a runtime directory controlled by the operator (default ~/oc/shopify-runtime). always is false and the skill does not request system-wide privilege changes; the service template is provided but must be installed manually by the operator.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install openclaw-shopify-manager - After installation, invoke the skill by name or use
/openclaw-shopify-manager - Provide required inputs per the skill's parameter spec and get structured output
Version History
v0.2.1
v0.2.1: redesign README and ClawHub-facing listing copy to be cleaner, more user-oriented, and more focused on Shopify outcomes and setup.
v0.2.0
v0.2.0: add smoother post-setup usage examples, support product lookup by title or id, add a canonical host installer helper, and ship a more plug-and-play sidecar compose starter.
v0.1.9
v0.1.9: add runtime .gitignore protection for .env/state/logs, extend doctor checks for runtime secret safety, and surface secret-handling guidance more clearly in the setup flow.
v0.1.8
v0.1.8: harden guided setup so Shopify secrets and the offline token stay in .env only by default, remove secret-passing examples from the public flow, and add explicit secret-handling guidance.
v0.1.7
v0.1.7: tighten ClawHub-facing metadata so the listing matches the guided low-friction setup flow and keep GitHub/ClawHub versions aligned.
v0.1.6
v0.1.6: add a guided setup flow, polish runtime diagnostics, add first-run success demo artifacts, and rework the install/setup path around a canonical low-friction install -> setup -> done flow.
v0.1.5
v0.1.5: reduce false-positive scanner signals by removing full webhook body logging, deleting one-time OAuth state after callback exchange, and clarifying least-privilege localhost-bound security behavior.
v0.1.4
v0.1.4: add the public project page to the GitHub repo metadata and README while keeping ClawHub aligned with the latest GitHub release.
v0.1.3
v0.1.3: add the public project page link to the GitHub repo and skill homepage metadata for ClawHub visibility.
v0.1.2
v0.1.2: declare Shopify env requirements, replace the referenced systemd asset with a registry-safe text template, and remove the remote installer-shell example from Tailscale guidance.
v0.1.1
v0.1.1: remove privileged helper scripts from the published skill bundle; keep GitHub as source of truth and ClawHub as release distribution only.
v0.1.0
Initial public release
Metadata
Frequently Asked Questions
What is Openclaw Shopify Manager?
Connect OpenClaw to Shopify with guided setup, local `.env` secret storage, Shopify OAuth, webhook validation, product and content operations, and host or Do... It is an AI Agent Skill for Claude Code / OpenClaw, with 179 downloads so far.
How do I install Openclaw Shopify Manager?
Run "/install openclaw-shopify-manager" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Openclaw Shopify Manager free?
Yes, Openclaw Shopify Manager is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Openclaw Shopify Manager support?
Openclaw Shopify Manager is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Openclaw Shopify Manager?
It is built and maintained by Dhawal (@dave8172); the current version is v0.2.1.
More Skills