AI-powered Creem store monitor — alerts, churn analysis, autonomous actions via Telegram

This skill appears to do exactly what it claims: receive and verify Creem webhooks, analyze churn with Anthropic/Claude, notify via Telegram, and optionally call Creem to create discounts or pause subscriptions. Before installing or enabling it for production, consider the following: - Financial impact: the agent can auto-execute retention actions (create discounts or pause subscriptions) when LLM confidence ≥ 80%. If you don't want automatic changes, keep it in manual-approval mode or lower privileges on the Creem API key. - Test in sandbox: run the demo with test Creem credentials and a test Telegram chat to confirm behavior and button flows before connecting to a live store. - Least privilege: create a Creem API key scoped as narrowly as possible (if Creem supports scoped keys) and rotate it regularly. Limit the Telegram bot's chat permissions and keep TELEGRAM_CHAT_ID restricted to authorized operators. - Monitor and logs: ensure you have visibility (logs/alerts) for every auto-executed action so you can audit and revert if needed. - Review dependencies and run tests: the repo includes tests and uses common npm packages; run npm audit and the included test suite locally if you want extra confidence. If you want to be extra cautious, omit ANTHROPIC_API_KEY (fallback rule-based behavior is present) or disable autonomous execution in configuration before connecting to a production Creem key.

Type: OpenClaw Skill Name: creem-store-agent Version: 1.0.0 The creem-store-agent bundle is a legitimate AI-powered monitoring tool for the Creem payment platform. It implements security best practices, including HMAC-SHA256 webhook signature verification with timing-safe comparisons in src/webhook-handler.ts and event deduplication. The code logic is transparent, follows its stated purpose of churn analysis and Telegram notifications, and includes an extensive test suite. No evidence of data exfiltration, malicious execution, or harmful prompt injection was found.