Xpersona
Claim this agent
agentCLAWHUBUnverified

Shop

Ultimate personal shopping assistant: find, compare, buy, gift, and reorder products across the Shop catalog containing millions of stores. Tracks orders and... Skill: Shop Owner: shopify Summary: Ultimate personal shopping assistant: find, compare, buy, gift, and reorder products across the Shop catalog containing millions of stores. Tracks orders and... Tags: latest:1.0.5, shop:2.9.3, shopify:2.9.3, shopping:2.9.3 Version history: v1.0.5 | 2026-06-24T11:45:00.230Z | user Add --country to checkout create for presentment currency localization v1.0.2 | 2026-06-17T15:42:56.149

OpenClaw
View on ClawHubHomepage

Rank

62

Safety

84

Downloads

3.3k

Updated

Oct 9, 2026

Version

1.0.5

Source

CLAWHUB

About

What it does, and when to use it.

Capability contract not published. No trust telemetry is available yet. 3.3K downloads reported by the source. Last updated 10/9/2026.

Avoid when

  • Contract metadata is missing or unavailable for deterministic execution.

Risk flags: missing_or_unavailable_contract, trust_data_unavailable, schema_references_missing

Public facts

Every fact links back to the source it came from.

Vendor
Clawhubvendor · observed Oct 9, 2026
Protocol compatibility
OpenClawcompatibility · observed Oct 9, 2026
Adoption signal
3.3K downloadsadoption · observed Oct 9, 2026
Latest release
1.0.5release · observed Jun 24, 2026
Handshake status
UNKNOWNsecurity

Install and run

Setup complexity: low.

clawhub skill install s17fzb320neysj8qkd5p0kxaqn83nnvh:shop
  1. Setup complexity is classified as HIGH. You must provision dedicated cloud infrastructure or an isolated VM. Do not run this directly on your local workstation.
  2. Final validation: Expose the agent to a mock request payload inside a sandbox and trace the network egress before allowing access to real customer data.

Contract: missing

curl -s "https://www.xpersona.co/api/v1/agents/clawhub-shopify-shop/snapshot"

Documentation

CLAWHUB

153,169 characters of source documentation, loaded on request.

Extracted files

5 files captured from the source.

SKILL.md

---
name: shop
description: "Ultimate personal shopping assistant: find, compare, buy, gift, and reorder products across the Shop catalog containing millions of stores. Tracks orders and deliveries for any retailer — including orders placed elsewhere, like Amazon, via your connected email. Helps get order info and initiate returns and refunds."
metadata:
  version: "1.0.1"
  homepage: "https://shop.app"
---

# Shop CLI Skill

## Setup
Prefer the installed `shop` CLI. If package installation is blocked, the reference files mirror every CLI call via the direct API, no local execution needed.

```bash
pnpm add --global @shopify/shop-cli   # or: npm install --global @shopify/shop-cli
shop --help
```

To upgrade: `pnpm add --global @shopify/shop-cli@latest` (or `npm install --global @shopify/shop-cli@latest`). Uninstall: `pnpm rm -g @shopify/shop-cli` (or `npm rm -g @shopify/shop-cli`).

**Reference files:**
- [catalog-mcp.md](references/catalog-mcp.md) — direct catalog MCP calls + manual token exchange
- [direct-api.md](references/direct-api.md) — auth, checkout, and orders API details
- [safety.md](references/safety.md) — safety, security, and prompt-injection rules
- [legal.md](references/legal.md) — personal-use limits and prohibited commercial uses

## IMPORTANT: Shopping flow
Every shopping conversation follows this order. Each step links to its rules below; each rule lives in exactly one place.

1. **Offer sign-in** — required once if signed-out, before any product message, then **STOP** and wait for the user to complete sign-in or decline. → *Sign in*
2. **Search** the catalog with `shop search`. → *Searching*
3. **Show results** — **one assistant message per product**, then one summary message. → *Showing products*
4. **Offer visualization** when the item is visual. → *Visualization*
5. **Checkout** on the merchant domain, only with clear purchase intent. → *Checkout*
6. **Orders** — tracking, returns, reorder (needs sign-in). → *Orders*

## Commands

### Catalog
`shop search` is the single entry point for catalog discovery: free-text, similar items (`--like-id`), and visual search (`--image`). A result's product link is the product page; run `get-product` for a variant's `checkout_url`. Use `lookup` for IDs you already hold (orders, wishlist, reorder); add `--include-unavailable` to resurface out-of-stock items.

```text
global                   --country <ISO2> (context signal, NOT a ships-to filter)
                         --currency <code> (context signal, e.g. GBP; localizes prices)
                         --format md|json (default to md; be STRONGLY averse to using json - results are huge and it burns lots of tokens)
search [query]           --ships-to <ISO2> [--ships-to-region, --ships-to-postal]
                         --limit 1-50 (keep small), --cursor <c> (next page), --min/--max-price (minor units; 15000 = $150.00)
                         --condition new,secondhand (default new), --ships-from <ISO2,...> (comma list)

_meta.json

{
  "ownerId": "kn722467n8vny3mcsqqkdk3g2d81yve6",
  "slug": "shop",
  "version": "1.0.5",
  "publishedAt": 1782301500230
}

references/catalog-mcp.md

# Direct Global Catalog MCP

Use this reference when the CLI cannot be installed or when you need to inspect the raw request shape. Product search must use Shopify Global Catalog MCP.

Endpoint:

```text
POST https://catalog.shopify.com/api/ucp/mcp
Content-Type: application/json
User-Agent: shop-cli/0.1.0
```

## Authentication (optional, preferred)

The `shop` CLI does this automatically: when the buyer is signed in (`shop auth status`), it mints a catalog token and authenticates every catalog call; otherwise it searches unauthenticated. Only do the steps below by hand when the CLI cannot be installed.

Signing in is **not required** — unauthenticated calls (profile only, no `Authorization`) still work. When you have an `access_token` (see device authorization in [direct-api.md](direct-api.md)), exchange it for a catalog token and send that as `Authorization: Bearer` on the MCP calls below:

```text
POST https://shop.app/oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=urn:ietf:params:oauth:grant-type:token-exchange
subject_token=<access_token>
subject_token_type=urn:ietf:params:oauth:token-type:access_token
requested_token_type=urn:ietf:params:oauth:token-type:access_token
audience=api.shopify.com
client_id=5c733ab2-1903-400a-891e-7ba20c09e2a3
```

The returned `access_token` is the catalog token. Keep it in memory only and add `Authorization: Bearer <catalog_token>` to the requests below; re-mint on process restart or a 401. `personal_agent` already grants catalog access, so no scope param is needed.

Every tool call includes:

```json
{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "id": 1,
  "params": {
    "name": "search_catalog",
    "arguments": {
      "meta": {
        "ucp-agent": {
          "profile": "https://shopify.dev/ucp/agent-profiles/2026-04-08/valid-with-capabilities.json"
        }
      },
      "catalog": {}
    }
  }
}
```

## Search

`search_catalog` discovers products across merchants. The request payload is wrapped in `arguments.catalog`.

```json
{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "id": 1,
  "params": {
    "name": "search_catalog",
    "arguments": {
      "meta": {
        "ucp-agent": {
          "profile": "https://shopify.dev/ucp/agent-profiles/2026-04-08/valid-with-capabilities.json"
        }
      },
      "catalog": {
        "query": "trail running shoes",
        "pagination": { "limit": 10 },
        "context": {
          "address_country": "US",
          "intent": "Customer runs marathons and wants road shoes"
        },
        "filters": {
          "available": true,
          "ships_to": { "country": "US" },
          "ships_from": [{ "country": "US" }, { "country": "CA" }],
          "price": { "max": 15000 },
          "condition": ["new"],
          "attributes": [
            { "name": "Color", "values": ["White", "Blue"] },
            { "name": "Size", "values": ["M"] },
            { "name": "Target gender", "values": ["Female"] }
          ]
        }

references/direct-api.md

# Direct Auth, Checkout, And Orders API

Use this reference when the CLI cannot be installed. Prefer the CLI when allowed because it handles token storage, request construction, and JSON-RPC envelopes consistently.

## Token Storage

Use the OS secret store with service `shop-agent` and accounts:

- `access_token`
- `refresh_token`
- `device_id`
- `country`

Keep checkout JWTs, buyer IP, and UCP-returned payment tokens in memory only.

## Device Authorization

Request a device code:

```text
POST https://accounts.shop.app/oauth/device
Content-Type: application/x-www-form-urlencoded

client_id=5c733ab2-1903-400a-891e-7ba20c09e2a3
scope=openid email personal_agent
device_name=<your name> - <device>   # e.g. Max - Mac Mini; name from IDENTITY.md (OpenClaw) / ~/.hermes/SOUL.md (Hermes)
```

Show `verification_uri_complete` to the user. Poll:

```text
POST https://accounts.shop.app/oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=urn:ietf:params:oauth:grant-type:device_code
device_code=<device_code>
client_id=5c733ab2-1903-400a-891e-7ba20c09e2a3
```

Handle `authorization_pending`, `slow_down`, `expired_token`, and `access_denied`. Store `access_token` and `refresh_token` on success.

Validate:

```text
GET https://accounts.shop.app/oauth/userinfo
Authorization: Bearer <access_token>
```

Refresh:

```text
POST https://accounts.shop.app/oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=refresh_token
refresh_token=<refresh_token>
client_id=5c733ab2-1903-400a-891e-7ba20c09e2a3
```

## Checkout Token Exchange

For each merchant domain, mint a short-lived checkout JWT:

```text
POST https://shop.app/oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=urn:ietf:params:oauth:grant-type:token-exchange
subject_token=<access_token>
subject_token_type=urn:ietf:params:oauth:token-type:access_token
resource=https://{shop_domain}/
client_id=5c733ab2-1903-400a-891e-7ba20c09e2a3
```

If the merchant endpoint returns auth/permission errors, hand off with the variant `checkout_url`, product URL, or seller URL instead of retrying the same agent checkout.

Use the returned JWT only in memory:

```text
POST https://{shop_domain}/api/ucp/mcp
Authorization: Bearer <ucp_jwt>
Content-Type: application/json
Shopify-Buyer-Ip: <buyer_public_ip>
```

Fetch the buyer's public IP immediately before checkout calls and keep it in
memory only. Shopify forwards it as `Shopify-Buyer-Ip` to run checkout
fraud/risk checks, the same as any web checkout:

```text
GET https://api.ipify.org?format=json
```

## Create Checkout

Create with line items, or pass a checkout body that already contains a `cart_id` and any required fields:

```json
{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "id": 1,
  "params": {
    "name": "create_checkout",
    "arguments": {
      "meta": {
        "ucp-agent": {
          "profile": "https://shopify.dev/ucp/agent-profiles/2026-04-08/personal_agent.json"
        }
      },
      "checkout": {

references/legal.md

# Legal

This skill is for **individual end-users** only. Building commercial services, resale platforms, aggregators, or anything that provides third parties with programmatic access to Shopify's catalog, checkout, delegated payments, or aggregated user data is prohibited. Go to [https://help.shop.app/en/shop/shopping/personal-agents](https://help.shop.app/en/shop/shopping/personal-agents) to learn more about accepted and prohibited use.

Related agents

Same protocol, similar job.

Github ReposUpdated 6mo agoRank 70

activepieces

AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents

OPENCLAW
Github ReposUpdated 6mo agoRank 70

cherry-studio

AI productivity studio with smart chat, autonomous agents, and 300+ assistants.

MCPOPENCLAW
Github ReposUpdated 6mo agoRank 70

AionUi

Free, local, open-source 24/7 Cowork app and OpenClaw for Gemini CLI, Claude Code, Codex, OpenCode, Qwen Code, Goose CLI, Auggie, and more | 🌟 Star if you like it!

MCPOPENCLAW
Github ReposUpdated 7mo agoRank 70

CopilotKit

The Frontend for Agents & Generative UI. React + Angular

OPENCLAW

Machine-readable data

The same record, as JSON, for agents and crawlers.

{
  "facts": [
    {
      "factKey": "vendor",
      "category": "vendor",
      "label": "Vendor",
      "value": "Clawhub",
      "href": "https://clawhub.ai/shopify/skills/shop",
      "sourceUrl": "https://clawhub.ai/shopify/skills/shop",
      "sourceType": "profile",
      "confidence": "medium",
      "observedAt": "2026-10-09T08:38:40.647Z",
      "isPublic": true
    },
    {
      "factKey": "protocols",
      "category": "compatibility",
      "label": "Protocol compatibility",
      "value": "OpenClaw",
      "href": "https://www.xpersona.co/api/v1/agents/clawhub-shopify-shop/contract",
      "sourceUrl": "https://www.xpersona.co/api/v1/agents/clawhub-shopify-shop/contract",
      "sourceType": "contract",
      "confidence": "medium",
      "observedAt": "2026-10-09T08:38:40.647Z",
      "isPublic": true
    },
    {
      "factKey": "traction",
      "category": "adoption",
      "label": "Adoption signal",
      "value": "3.3K downloads",
      "href": "https://clawhub.ai/shopify/shop",
      "sourceUrl": "https://clawhub.ai/shopify/shop",
      "sourceType": "profile",
      "confidence": "medium",
      "observedAt": "2026-10-09T08:38:40.647Z",
      "isPublic": true
    },
    {
      "factKey": "latest_release",
      "category": "release",
      "label": "Latest release",
      "value": "1.0.5",
      "href": "https://clawhub.ai/shopify/shop",
      "sourceUrl": "https://clawhub.ai/shopify/shop",
      "sourceType": "release",
      "confidence": "medium",
      "observedAt": "2026-06-24T11:45:00.230Z",
      "isPublic": true
    },
    {
      "factKey": "handshake_status",
      "category": "security",
      "label": "Handshake status",
      "value": "UNKNOWN",
      "href": "https://www.xpersona.co/api/v1/agents/clawhub-shopify-shop/trust",
      "sourceUrl": "https://www.xpersona.co/api/v1/agents/clawhub-shopify-shop/trust",
      "sourceType": "trust",
      "confidence": "medium",
      "observedAt": null,
      "isPublic": true
    }
  ],
  "events": [
    {
      "eventType": "release",
      "title": "Release 1.0.5",
      "description": "Add --country to checkout create for presentment currency localization",
      "href": "https://clawhub.ai/shopify/shop",
      "sourceUrl": "https://clawhub.ai/shopify/shop",
      "sourceType": "release",
      "confidence": "medium",
      "observedAt": "2026-06-24T11:45:00.230Z",
      "isPublic": true
    }
  ]
}

Record generated Oct 9, 2026.

Sponsored

Ads related to Shop and adjacent AI workflows.