Shopify Launch Strategy

Build a new product launch playbook for Shopify stores with pre-launch hype, launch day tactics, and post-launch momentum. Triggers: product launch strategy,...

This skill appears coherent for generating a Shopify launch playbook, but exercise caution before running the included script. The analyze.sh script invokes an 'openclaw' CLI that is not declared in the manifest — confirm whether that binary exists on your system, where it came from, and what network activity it performs. Inspect the openclaw CLI (or run the script in an isolated/sandbox environment) to ensure prompts are not sent to an unexpected remote endpoint. If you don't want the skill to call a local agent automatically, you can copy the prompt from analyze.sh and run it manually against a model you trust or have verified. If you plan to install/run this skill in production, check the linked GitHub repo for provenance and any additional documentation or release artifacts that explain the openclaw dependency.

Type: OpenClaw Skill Name: shopify-launch-strategy Version: 1.0.0 The skill contains a shell injection vulnerability in `analyze.sh`. The script takes unsanitized user input via the `${INPUT}` variable and embeds it directly into a double-quoted string (`PROMPT`), which allows for command execution through subshell syntax (e.g., `$(...)` or backticks). While the skill's logic is aligned with its stated purpose of generating Shopify marketing strategies, this lack of input sanitization is a high-risk vulnerability.