Shopping Claw | Is your claw a shopaholic?

Tryout shopping on Shopify with CreditClaw and backed by Stripe. You can shop anywhere.

This skill is a coherent shopping/checkout integration that legitimately needs an API key to call creditclaw.com and to request one-time decryption keys for card data — that part matches its purpose. Before installing: (1) confirm the registry listing and the skill's own files agree about required environment variables (the skill's files require CREDITCLAW_API_KEY even though the top-level summary said none), (2) only provide an API key if you trust creditclaw.com and understand that the agent will be able to request and use one-time decrypted card details in memory, (3) ensure the agent's approval_mode remains restrictive (ask_for_everything) unless you intentionally want it to spend autonomously, (4) keep webhook_secret and CREDITCLAW_API_KEY in a secure secrets manager and never expose them to other services, and (5) review the service's privacy/security documentation and consider testing in a sandbox or with very small limits before enabling live spending. If you want, I can list the exact lines in the skill files that show the inconsistent metadata and the endpoints that return or require keys.

Type: OpenClaw Skill Name: shopify-pay2 Version: 1.0.1 The skill bundle integrates the CreditClaw platform to provide AI agents with financial capabilities, including automated browser-based checkouts on platforms like Shopify and Amazon. While the bundle includes robust security measures—such as ephemeral sub-agent isolation, server-side guardrails, and AES-256-GCM encryption—the inherent nature of the skill involves high-risk behaviors like handling decrypted credit card data and automated form filling (documented in CHECKOUT-GUIDE.md and agents/OPENCLAW.md). Consequently, it is classified as suspicious due to these risky capabilities, although no evidence of malicious intent or unauthorized data exfiltration was found in the provided files.