clishop-43c986 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited clishop-43c986 (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
CLISHOP is an open-source MCP server and CLI that lets AI agents search for products across multiple stores, compare prices, and place real orders — all from the terminal.
46 MCP tools for the full shopping lifecycle: search → compare → buy → track → review → return.
npm install -g clishopUse the email-first setup command:
clishop setup start --email [email protected] --jsonThen search products, and only add an address or payment method when the user is ready to buy.
clishop-mcp # If installed globally
node ./dist/mcp.js # From the installed package directoryWhen CLISHOP is installed in OpenClaw, prefer the MCP tools exposed by the CLISHOP server instead of shell commands.
clishop__<tool_name> naming pattern, for example clishop__list_addresses, clishop__add_address, clishop__set_default_address, clishop__add_payment_method, clishop__list_payment_methods, and clishop__buy_product.clishop address add or other CLI subcommands.clishop__add_payment_method or add_payment_method to generate a secure setup link for the human. Do not ask the user to paste card details into chat.clishop__list_addresses or list_addresses first to check existing saved addresses.clishop__set_default_address or set_default_address if needed.clishop__add_address or add_address directly with the known fields.setDefault: true when adding the main home address.clishop__list_payment_methods or list_payment_methods first to see whether a payment method already exists.clishop__add_payment_method or add_payment_method.setupUrl to the human and tell them to complete payment setup in the secure web portal.clishop__list_payment_methods again.clishop__set_default_payment_method or set_default_payment_method with the chosen payment method ID.The agent must never collect raw card details in chat. The secure web flow is the supported path.
Required fields for add_address:
labelfirstNamelastNameline1citypostalCodecountryOptional fields:
line2regionphonecompanyNamevatNumbertaxIdinstructionssetDefaultExample add_address payload for a US home address in San Francisco:
{
"label": "Home",
"firstName": "Alex",
"lastName": "Johnson",
"line1": "1234 Hayes Street",
"city": "San Francisco",
"region": "CA",
"postalCode": "94117",
"country": "United States",
"phone": "+14155550123",
"instructions": "Leave at front door",
"setDefault": true
}| Tool | Description | Read-only |
|---|---|---|
setup | Create or sign in with an email address (completes immediately) | ❌ |
setup_status | Check a legacy setup session by setup_id | ✅ |
search_products | Search across all connected stores with filters (price, brand, category, shipping, ratings) | ✅ |
get_product | Get detailed info about a specific product | ✅ |
buy_product | Place an order (respects agent safety limits) | ❌ |
list_orders | List orders, optionally filtered by status | ✅ |
get_order | Full order details including tracking and shipments | ✅ |
cancel_order | Cancel a pending or confirmed order | ❌ |
list_addresses | List saved shipping addresses | ✅ |
add_address | Add a new shipping address | ❌ |
remove_address | Remove a saved address | ❌ |
set_default_address | Set the default shipping address for the active agent | ❌ |
list_payment_methods | List saved payment methods | ✅ |
add_payment_method | Generate a secure payment-setup link for the human | ❌ |
remove_payment_method | Remove a saved payment method | ❌ |
set_default_payment_method | Set the default payment method for the active agent | ❌ |
list_stores | Browse available stores | ✅ |
get_store | View store details | ✅ |
store_catalog | Browse a store's product catalog | ✅ |
account_status | Full account overview (user, agents, addresses, payments) | ✅ |
list_agents | List safety profiles (spending limits, allowed categories) | ✅ |
get_agent | View details of a specific agent | ✅ |
create_agent | Create a new agent (safety profile) with spending limits | ❌ |
update_agent | Update an agent's settings (limits, categories, defaults) | ❌ |
switch_agent | Switch the active agent | ❌ |
get_spending_limit | View the current monthly spending limit | ✅ |
set_spending_limit | Change the monthly spending limit | ❌ |
add_product_review | Write a product review (1-10 rating) | ❌ |
add_store_review | Write a store review (1-10 rating) | ❌ |
list_reviews | List all your product and store reviews | ✅ |
get_product_rating | View rating details for a product | ✅ |
get_store_rating | View rating details for a store | ✅ |
delete_review | Delete one of your reviews | ❌ |
create_advertise_request | Post a request for vendors to bid on | ❌ |
list_advertise_requests | List your advertised requests | ✅ |
get_advertise_request | View an advertised request and its bids | ✅ |
accept_advertise_bid | Accept a vendor's bid | ❌ |
reject_advertise_bid | Reject a vendor's bid | ❌ |
cancel_advertise_request | Cancel an open advertised request | ❌ |
create_support_ticket | Create a support ticket for an order | ❌ |
list_support_tickets | List support tickets | ✅ |
get_support_ticket | View a support ticket and its message history | ✅ |
reply_to_support_ticket | Send a reply to a support ticket | ❌ |
close_support_ticket | Close a resolved support ticket | ❌ |
submit_feedback | Report a bug or suggest an improvement | ❌ |
list_feedback | List your submitted bug reports and suggestions | ✅ |
get_feedback | View details of a specific feedback item | ✅ |
All network requests go to the CLISHOP API:
| Endpoint | Method | Data sent | Purpose |
|---|---|---|---|
/auth/setup-link | POST | Email address | Create account / sign in |
/products/search | GET | Search query, filters (category, brand, price range, country) | Product search |
/products/:id | GET | Product ID | Product details |
/products/extended/:id | GET | Product ID | Extended product lookup across vendor stores |
/orders | GET | Status filter, page | List user's orders |
/orders | POST | Product ID, quantity, address ID, payment ID, agent name | Place an order |
/orders/:id | GET | Order ID | Order details |
/orders/:id/tracking | GET | Order ID | Shipment tracking |
/orders/:id/cancel | POST | Order ID | Cancel an order |
/addresses | GET | Agent name | List addresses |
/addresses | POST | Full address fields (name, street, city, country, etc.) | Add address |
/addresses/:id | DELETE | Address ID | Remove address |
/payment-methods | GET | Agent name | List payment methods |
/payment-methods/:id | DELETE | Payment method ID | Remove payment method |
/stores | GET | Query, filters | Browse stores |
/stores/:id | GET | Store ID/slug | Store details |
/stores/:id/products | GET | Query, filters | Store catalog |
/agents | GET | — | List agents |
/spending-limit | GET/PATCH | Limit in cents | Get/set spending limit |
/products/:id/reviews | POST | Rating, title, body | Product review |
/stores/:id/reviews | POST | Rating, title, body | Store review |
/reviews/mine | GET | — | List own reviews |
/products/:id/rating | GET | — | Product rating details |
/stores/:id/rating | GET | — | Store rating details |
/advertise | GET/POST | Title, description, brand, quantity, max bid price | Advertise requests |
/advertise/:id | GET | — | Advertise request details |
/advertise/:id/bids/:id/accept | POST | — | Accept bid |
/advertise/:id/bids/:id/reject | POST | — | Reject bid |
/advertise/:id/cancel | POST | — | Cancel advertise request |
/support | GET/POST | Ticket details or status filter | Support tickets |
/support/:id | GET | — | Support ticket details |
/support/:id/reply | POST | Message | Reply to support ticket |
/support/:id/status | PATCH | Status | Close support ticket |
/feedback | GET/POST | Feedback type, title, description | Feedback |
/feedback/:id | GET | — | Feedback details |
All requests are sent over HTTPS to https://clishop-backend.vercel.app/api.
maxOrderAmount), category allow/block lists, and confirmation requirements are enforced client-side before any order is placed.By using this skill, your search queries, shipping addresses, payment method references, and order details are sent to the CLISHOP API (clishop-backend.vercel.app). The API acts as a gateway to registered vendor stores. No data is sold or shared with third parties beyond what is necessary to fulfill orders.
This skill is designed for autonomous invocation by AI agents via the Model Context Protocol (MCP). When an MCP client (e.g. Claude Desktop, Cursor, VS Code Copilot) calls these tools, the agent may search for products, place orders, and manage account data on the user's behalf — subject to the safety thresholds configured in the user's agent profile.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.