Skills shopify-automation
📦

shopify-automation

Content revision r1 Medium Risk ⚙️ External commands🌐 Network access

Automate Shopify Store Operations

Shopify store tasks often require many API tools and careful pagination. This skill guides Claude, Codex, and Claude Code through Rube MCP workflows for common store operations.

Supports: Claude Codex Code(CC)
⚠️ 50 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "shopify-automation" from https://skillstore.io/skills/sickn33-shopify-automation.md and its manifest at https://skillstore.io/api/skills/sickn33-shopify-automation/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/sickn33-shopify-automation.md Signed manifest GET /api/skills/sickn33-shopify-automation/manifest Signed lockfile GET /api/skills/sickn33-shopify-automation/lockfile

Test it

Using "shopify-automation". Show me open Shopify orders from the last week.

Expected outcome:

A concise order summary with order IDs, financial status, fulfillment status, and next review actions.

Using "shopify-automation". Check stock for these inventory items at all locations.

Expected outcome:

A location-by-location inventory report that highlights low stock and missing location data.

Using "shopify-automation". Prepare a smart collection for sale products.

Expected outcome:

A proposed collection plan with rule criteria, affected products, and confirmation steps before creation.

Security Audit

Medium Risk
v4 • 7/7/2026 Open versioned report

Most static shell-execution findings are false positives caused by Markdown backticks around MCP and Shopify tool names. The real risks are the required third-party Rube MCP OAuth connection and documented Shopify write operations, which need clear consent and permission boundaries.

1
Files scanned
169
Lines analyzed
1
Review items
0
False positives ignored

Confirmed security concerns (2)

Medium
SKILL.md:20-26
Third-Party MCP Access to Shopify Data
The skill requires adding Rube MCP and completing Shopify OAuth before store workflows run. That gives a third-party MCP provider access to Shopify products, orders, customers, inventory, and related operations.
The setup instructions explicitly name the Rube MCP endpoint and require a Shopify OAuth connection. The surrounding workflow sections show broad store data access through that connection.
Medium
SKILL.md:37SKILL.md:93-94
Shopify Store Write Operations Need Confirmation
The skill documents bulk product creation, smart collection creation, and adding products to collections. These are legitimate features, but they can materially change a store if run without explicit approval.
The cited lines directly list Shopify write-capable tools. There is no matching instruction that requires a dry run or user confirmation before write actions.
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Low
SKILL.md:20
Hardcoded URL
**Get Rube MCP**: Add `https://rube.app/mcp` as an MCP server in your client configuration. No API k
Line 20 instructs users to add the external Rube MCP endpoint. This is expected for the skill, but it creates a real third-party network and OAuth trust boundary.

Risk Factors

⚙️ External commands (40)
SKILL.md:15 SKILL.md:16 SKILL.md:20 SKILL.md:23 SKILL.md:24 SKILL.md:35 SKILL.md:36 SKILL.md:37 SKILL.md:38 SKILL.md:41 SKILL.md:42 SKILL.md:43 SKILL.md:44 SKILL.md:55 SKILL.md:56 SKILL.md:57 SKILL.md:58 SKILL.md:61 SKILL.md:62 SKILL.md:63 SKILL.md:64 SKILL.md:65 SKILL.md:76 SKILL.md:79 SKILL.md:80 SKILL.md:91 SKILL.md:92 SKILL.md:93 SKILL.md:94 SKILL.md:95 SKILL.md:98 SKILL.md:99 SKILL.md:100 SKILL.md:111 SKILL.md:112 SKILL.md:115 SKILL.md:116 SKILL.md:126 SKILL.md:127 SKILL.md:133-136
🌐 Network access (1)
SKILL.md:20
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/sickn33-shopify-automation/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/sickn33-shopify-automation/security.svg)](https://skillstore.io/skills/sickn33-shopify-automation?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/sickn33-shopify-automation?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-shopify-automation/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/sickn33-shopify-automation.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

sickn33. (2026). shopify-automation security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-shopify-automation/audits/4

BibTeX citation

@techreport{sickn33-sickn33-shopify-automation-2026, author = {sickn33}, title = {shopify-automation security audit report (audit version 4)}, institution = {Skillstore}, year = {2026}, number = {4}, url = {https://skillstore.io/skills/sickn33-shopify-automation/audits/4}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "shopify-automation security audit report (audit version 4)" version: "unspecified" type: report authors: - name: "sickn33" date-released: "2026-07-07" url: "https://skillstore.io/skills/sickn33-shopify-automation/audits/4" identifiers: - type: other value: "skillstore:sickn33-shopify-automation:audit:4" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High
55
Architecture
85
Maintainability
87
Content
68
Community
83
Spec Compliance

What You Can Build

Review Product Catalogs

List products, inspect individual product records, and count catalog items before merchandising updates.

Track Orders and Fulfillment

Filter orders by status, inspect order details, and review fulfillment events for support questions.

Monitor Inventory by Location

Check inventory levels across locations and prepare stock reports for replenishment planning.

Try These Prompts

Check Connection 
Confirm that Rube MCP is available, search for the current Shopify tool schemas, and verify whether my Shopify connection is active.
List Recent Orders 
Use the Shopify tools through Rube MCP to list recent open orders. Include payment status, fulfillment status, and order identifiers.
Audit Inventory Levels 
Search the current Shopify schemas, list store locations, and check inventory levels for these inventory item IDs across relevant locations.
Plan Catalog Updates 
Search current tool schemas, review products for this vendor, identify collection membership, and propose any product or collection changes before applying them.

Best Practices

  • Search Rube tool schemas before each task because Shopify tool inputs can change.
  • Confirm the active Shopify connection and intended store before reading or changing data.
  • Ask for explicit approval before bulk product creation, collection changes, or GraphQL mutations.

Avoid

  • Do not assume default order filters include every order status.
  • Do not run bulk create or collection updates without a preview and user confirmation.
  • Do not ignore pagination, cursor handling, or Shopify rate limits on large stores.

Frequently Asked Questions

Does this skill require Shopify API keys?
The skill expects Rube MCP and Shopify OAuth authorization. It does not include direct API key setup.
Can it create Shopify products?
Yes, it documents bulk product creation through the Shopify toolkit when the connected account has permission.
Can it manage orders?
It can list orders with filters, retrieve order details, and inspect fulfillment information through Rube MCP.
Does it support inventory workflows?
Yes, it can guide inventory level checks and location listing through the documented Shopify tools.
Why does it search tools first?
Rube tool schemas can change. Searching first helps the agent use current inputs and avoid stale parameters.
What permissions should users review?
Users should review Shopify OAuth scopes, store identity, and any write permissions before running workflows.

Developer Details

Author

sickn33

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Repository

https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/shopify-automation

Ref

9f814fc6a43fd99946f2da5e0df231c65a38bc76

Maintenance freshness

7/18/2026

Usage

6 downloads · 89 views

File structure

📄 SKILL.md