GEO Visual Opportunity Engine workflow skill.
Security Analysis
high confidenceThe skill appears to implement the described Shopify/WooCommerce + image-generation workflow, but there are multiple incoherences and risky installation sources (undeclared credentials, one‑click download from an unfamiliar domain, and mismatched metadata) that warrant caution before installing or providing credentials.
The name/description (GEO Visual Opportunity Engine) align with the included code (image generation + Shopify/WooCommerce publishing). However the registry metadata declared no required environment variables or credentials while SKILL.md and the Python code clearly expect sensitive env vars (GOOGLE_API_KEY, SHOPIFY_STORE_URL/ACCESS_TOKEN, WOOCOMMERCE_*). The package also advertises repository/installation from 'clawhub.ai' rather than a well-known git host. These mismatches (declared vs actual requirements, repo host) are incoherent and should be explained by the author.
Runtime instructions and code are consistent about workflow steps (GEO analysis, prompt generation, image generation with Google Gemini, and API calls to Shopify/WooCommerce). The instructions explicitly require reading environment variables for API keys and publishing; they do not instruct reading unrelated system files. Still, SKILL.md grants broad runtime discretion (generate images, publish to platforms) which means any provided credentials will be used automatically by the code—user should be aware of that behavior.
The README/SKILL.md recommend a 'one‑click' curl/wget pip install flow that downloads a tarball from https://clawhub.ai/... and pipes it into tar then pip install -r requirements.txt. That URL is not a widely-known release host (e.g., github.com / official project domain) — downloading and extracting code from an unfamiliar domain increases risk. The code bundle itself is present in the skill listing (so installing may be unnecessary), but the one‑click command would execute arbitrary network downloads and a pip install: this pattern is higher risk and should be verified or replaced with a trusted source.
The skill will need multiple sensitive credentials to function (Google API key for Gemini, Shopify admin token, WooCommerce consumer key/secret) as shown in SKILL.md and used in code (config.py, nano_banana_2.py, shopify.py, woocommerce.py). The registry metadata, however, declares no required env vars/primary credential — this mismatch is significant. Requiring admin‑level Shopify/WooCommerce tokens is proportionate to the stated purpose, but only if the user understands the privileges those tokens grant and the repository source is trustworthy.
The skill is not marked always:true and does not claim to modify other skills or system-wide agent settings. It writes generated images to a local output directory and performs API calls to configured services. There is no evidence it persists beyond its own workspace or modifies unrelated agent configs.
Guidance
Do not provide production API keys or admin tokens until you verify the source. Actions to consider before installing or running: 1) Inspect the full code locally (already included in the package) rather than running the one‑click curl/wget; 2) Verify the repository origin and prefer a trusted host (GitHub/GitLab) or vendor-signed release instead of clawhub.ai tarballs; 3) For testing, create throwaway Google API key and limited Shopify/WooCommerce accounts with minimal permissions or sandbox stores; 4) If you decide to run it, run in an isolated environment/container and review network calls (requests usage) and the prompts/system_prompt.md for any hidden endpoints or telemetry; 5) Ask the author to correct registry metadata to declare required environment variables and to explain/replace the one‑click install URL. If you lack confidence in the origin, treat the package as untrusted and avoid installing it on production systems.
Latest Release
v1.0.6
Version 1.0.6 of geo-visual-opportunity-engine - No changes detected in the code or documentation. - Version number was incremented; all features and instructions remain the same as in 1.0.5.
Popular Skills
Published by @GEO-SEO on ClawHub
