Extract multilingual product data from Amazon and sync it to Shopify with automatic token renewal and English content rewriting via REST Admin API.

Do not install or run this skill as-is. Key issues: (1) the script contains hardcoded Shopify credentials (CLIENT_ID and CLIENT_SECRET) — this is sensitive and unexpected given the skill declares no required env vars; (2) SKILL.md and code are inconsistent (claims to extract from Amazon but the script lacks scraping/fetch logic and contains static product text); (3) the OAuth flow used (client_credentials) and the presence of two domains (dinoho.myshopify.com and dinoho.cn) are unexplained. Before using: ask the publisher to remove embedded secrets and declare required environment variables; require that auth use a documented, secure OAuth flow and that credentials belong to you; verify which domain/store the skill will access; review and test in a sandbox store; rotate any exposed credentials that might be real. If you need this functionality, prefer a version that accepts credentials via environment/config and clearly documents its Amazon scraping and Shopify API calls.

Type: OpenClaw Skill Name: amazon-to-shopify-sync Version: 1.0.0 The skill bundle contains hardcoded Shopify API credentials (CLIENT_ID and CLIENT_SECRET) within `scripts/sync.py`, which is a significant security vulnerability. The logic is also hardcoded to interact with a specific store domain (`dinoho.myshopify.com`) and uses static product data rather than dynamic extraction, which is inconsistent with its stated purpose of being a general Amazon-to-Shopify sync tool. While there is no clear evidence of intentional data exfiltration from the user, the exposure of sensitive keys and the highly specific, non-functional sync logic are suspicious.