Shopify Order Management

Shopify order lifecycle management with new order handling, status sync, low-stock alerts, abandoned cart recovery, and daily sales reports. 5 production-rea...

This package appears to do what it says: import the JSON workflows into your self-hosted n8n, provide a Shopify access token and webhook secret, create the Orders Google Sheet, and configure SMTP for emails. Before installing: (1) Verify and set SHOPIFY_ORDERS_SHEET_ID (the registry metadata omitted it); (2) Use least-privilege Shopify credentials (scopes limited to read_orders, read_products, read_checkouts or narrower as needed) and rotate them if possible; (3) Test webhook HMAC verification — the code uses JSON.stringify(body) which can fail depending on how your webhook raw body is presented; prefer verifying against the raw request body where possible; (4) Ensure your SMTP credentials are stored securely in n8n (do not bake them into environment variables in shared hosts); (5) Review privacy/consent for sending abandoned-cart emails to customers and follow applicable laws (CAN-SPAM, GDPR); (6) Import workflows only into a trusted n8n instance since code nodes execute JavaScript and will run with whatever access your n8n instance has. If you want higher assurance, ask the publisher to: include SHOPIFY_ORDERS_SHEET_ID in the registry metadata, confirm HMAC verification method, and provide a small README that maps each n8n credential to the minimal required scopes.

Type: OpenClaw Skill Name: shopify-order-management Version: 1.0.2 The OpenClaw skill bundle for Shopify order management appears benign. All five n8n workflows (`01-new-order-handler.json`, `02-order-status-sync.json`, `03-low-stock-alert.json`, `04-abandoned-cart-recovery.json`, `05-daily-sales-report.json`) perform their stated functions using legitimate Shopify Admin API endpoints and Google Sheets/SMTP integrations. The custom JavaScript code nodes are used for data parsing, filtering, and aggregation, including a proper HMAC signature verification for Shopify webhooks. There is no evidence of data exfiltration to unauthorized endpoints, malicious command execution, persistence mechanisms, or prompt injection attempts in the `SKILL.md` or workflow definitions. All requested environment variables and credentials are directly relevant to the skill's described functionality.