Order & Returns Manager

Manage UK-compliant Shopify and WooCommerce orders via chat, including status, returns, refunds, exchanges, edits, fraud flags, lost parcels, and reports.

This skill appears to do what it says (managing orders on Shopify/WooCommerce), but the published metadata inaccurately claims 'no credentials required' while the instructions require you to supply store API tokens and to let the bot store them. Before installing or using it: - Treat the required API tokens as highly sensitive. Create a dedicated custom app or API key pair with the minimum necessary scopes (least privilege) rather than using an owner/admin token. Limit write scopes where possible and rotate/revoke keys after testing. - Ask the skill/vendor (or the platform) where the tokens are stored: is the agent memory encrypted at rest, who can access it, and how long are keys retained? Confirm a way to delete or revoke stored credentials. - Don’t paste tokens into public channels. Prefer to enter them via a secure settings UI if available. - If you cannot verify secure storage or origin of the skill (source is unknown, no homepage), consider rejecting it or testing first with a low-privilege test store account and test tokens. - If you decide to proceed in production, limit liability by using an account with only the necessary Shopify/WooCommerce scopes and by monitoring access and token usage for anomalous activity. If the publisher can (a) update the registry metadata to declare required credentials, and (b) document how secrets are stored/secured and how to revoke them, that would materially reduce the concern.

Type: OpenClaw Skill Name: order-returns-manager Version: 1.0.0 The 'Order & Returns Manager' skill is a legitimate tool designed to manage Shopify and WooCommerce store operations. It handles sensitive tasks such as processing refunds, fulfilling orders, and detecting fraud, but includes robust business logic and safety guardrails, such as enforcing UK Consumer Rights Act compliance and requiring manual approval for high-value transactions. The instructions explicitly forbid the AI from logging or repeating access tokens (SKILL.md), and all network activity is directed toward the user's own store endpoints or well-known shipping carriers. No evidence of data exfiltration, malicious code execution, or harmful prompt injection was found.