myskill

Provides daily Shopify sales summaries, low stock alerts, and competitor price tracking using your Shopify API key.

This skill contains several contradictions and vague instructions. Before installing or providing credentials: 1) Ask the author to clarify and update SKILL.md and metadata to explicitly list required environment variables (Shopify API key, SMTP/Telegram credentials, any competitor API keys) and explain exactly how alerts are sent. 2) Confirm whether the agent will write cron jobs or otherwise modify system crontab; if so, require explicit, auditable instructions and prefer using an external scheduler or a separate, dedicated automation service. 3) Only provide a read-only Shopify API token scoped to minimal data needed, and use dedicated, limited-purpose alert credentials (a throwaway SMTP account or a bot token with narrow scope). 4) Request details on how competitor tracking works (which domains/APIs are contacted) and ask for safeguards against scraping sensitive endpoints. 5) Do not grant broad or production credentials until the skill's behavior is fully specified and you have assurance it won't alter system files. If the author cannot satisfactorily update the documentation and manifest to remove these mismatches, treat the skill as untrusted.

Type: OpenClaw Skill Name: surfisup-ecom-monitor Version: 1.0.1 The skill bundle contains significant contradictions and social engineering red flags. While README.md claims 'No persistence' and 'No code execution,' the SKILL.md instructions explicitly direct the agent to 'Set cron job' for daily monitoring. Furthermore, the CHANGELOG.md and README.md use defensive language ('flagged false positive', 'VirusTotal Clean') often associated with malicious packages attempting to bypass security reviews. While no explicit data exfiltration logic is present, the deceptive safety claims regarding persistence and the requirement for Shopify API keys make this bundle suspicious.