FD shopware-expert

Enable Shopware 6 superpowers for OpenClaw. Get a massive boost in knowledge about everything related to Shopware 6 in general and Shopware 6 development.

Not recommendedcritical or high security findings · low grade F

ClawHub Agent Skills author: realM1lF v1.0.5 MIT-0 63 files body ≈ 2 105 tokens Open the sourceclawhub.ai↗ analyzed 3 d ago

As a process D 49/100 · Unfinished process — weak spots: result and completion, when it triggers, inputs and preconditions

Procedure Infrastructuretype and topics are labelled automatically from the skill text

Runs in: OpenClaw Claude / Claude Code ChatGPT / Codex Gemini CLI Cursor GitHub Copilot / VS Code Qwen Code Kimi Code CLI Z.ai (GLM) DeepSeek (Deep Code) Mistral Vibe LangChain (deepagents) Goose OpenCode

JSON

Technical rating

29/100

safety, quality, tests

Safety 60%: 0
Quality 40%: 72
Run on models: none yet

Process rating

49/100

Unfinished process

Result and completion w 14: 0
Inputs and preconditions w 11: 0
Progress reporting w 2: 0

the three weakest of ten parameters · all ten

What is at stake

The skill contains fragments that, in the wrong hands, cost money or data. Below: what the installer risks and what the author should do.

Exfiltration

If you install

The instructions or scripts send data out: environment variables, keys, file contents, chat history. You may never notice, because the agent performs the upload as "part of the task".

For the author

If the upload is not needed for the task, remove it: catalogs flag such skills and delist them. If it is needed, name the destination explicitly, say what leaves the machine, and give the user a switch.

Dangerous commands

If you install

The skill contains commands that delete files, rewrite disks or execute code fetched from the network. The agent may run them without asking if it believes the instructions require it.

For the author

Replace destructive commands with safe equivalents that ask for confirmation, scope them to one folder, and stop piping curl into a shell: pin a version and a checksum.

Obfuscation medium severity

Below is the worst case for this category. The finding here is medium: the guard saw a sign, not a proof.

If you install

The files contain invisible characters, encoded commands or comments hidden from readers but visible to the model. What you read differs from what the agent sees.

For the author

Remove invisible characters (they usually sneak in through copy-paste) and encoded strings: no catalog will pass them. Instructions for the model must be readable by a human too.

How to improve

Address the high-severity findings: each costs 18 safety points. If one is a false positive, add the rule id to guard.allow in spec.yaml.
Say in the description WHEN to use the skill ("use when…", example requests): that is the agent's main cue.

For the model run — optional

Your own cases (evals/evals.json, 4–6 real requests with expected answers): the full check would then run those instead of a model-drafted suite.
A spec.yaml with trigger phrases and assertions — a behaviour contract for CI; `skilltest init` writes a template.

Guard findings · 62

high Exfiltration exfil-webhook-url references/APP_SYSTEM_PART2.md:229

Webhook / callback URL commonly used for exfiltration (verify the destination)
```
POST https://hooks.slack.com/services/{id} {
```
high Dangerous commands cmd-pipe-to-shell references/INSTALLATION_AND_HOSTING_PART2.md:2055

Downloads and executes remote code from an unrecognised host (pipe to shell)
```
sh <(curl -L https://nixos.org/nix/install)
```
high Dangerous commands cmd-pipe-to-shell references/INSTALLATION_AND_HOSTING_PART2.md:2059

Downloads and executes remote code from an unrecognised host (pipe to shell)
```
sh <(curl -L https://nixos.org/nix/install) --daemon
```
high Dangerous commands cmd-pipe-to-shell references/INSTALLATION_AND_HOSTING_PART2.md:2063

Downloads and executes remote code from an unrecognised host (pipe to shell)
```
sh <(curl -L https://nixos.org/nix/install) --no-daemon
```
high Dangerous commands cmd-pipe-to-shell references/INSTALLATION_AND_HOSTING_PART3.md:313

Downloads and executes remote code from an unrecognised host (pipe to shell)
```
curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix | sh -s -- install
```
high Exfiltration exfil-webhook-url references/PRODUCT_EXTENSIONS_OVERVIEW_PART5.md:882

Webhook / callback URL commonly used for exfiltration (verify the destination)
```
cors_origins http://loca…000 http://loca…080 http://shopware.test http://7779….io
```
high Exfiltration exfil-webhook-url references/PRODUCT_EXTENSIONS_OVERVIEW.md:3024

Webhook / callback URL commonly used for exfiltration (verify the destination)
```
cors_origins http://loca…000 http://loca…080 http://shopware.test http://7779….io
```

Medium and low: 55

medium Obfuscation obf-base64-blob references/INSTALLATION_AND_HOSTING_PART2.md:1824

Long base64-looking blob

* [PdoSessionHandler](https://github.com/symfony/symfony/blob/6.3/src/Symfony/Component/HttpFoundation/Session/Storage/Handler/PdoSessionHandler.php)

medium Obfuscation obf-base64-blob references/INSTALLATION_AND_HOSTING_PART2.md:1825

Long base64-looking blob

* [MemcachedSessionHandler](https://github.com/symfony/symfony/blob/6.3/src/Symfony/Component/HttpFoundation/Session/Storage/Handler/MemcachedSessionHandler.php)

medium Obfuscation obf-base64-blob references/INSTALLATION_AND_HOSTING_PART2.md:1826

Long base64-looking blob

* [MongoDbSessionHandler](https://github.com/symfony/symfony/blob/6.3/src/Symfony/Component/HttpFoundation/Session/Storage/Handler/MongoDbSessionHandler.php)

medium Dangerous commands cmd-privilege references/INSTALLATION_AND_HOSTING_PART2.md:2119

Privilege escalation / world-writable permissions
```
echo "trusted-users = root ${USER}" | sudo tee -a /etc/nix/nix.conf && sudo pkill nix-daemon
```
medium Dangerous commands cmd-privilege references/INSTALLATION_AND_HOSTING_PART2.md:3019

Privilege escalation / world-writable permissions
```
sudo cp ~/.composer/vendor/weprovide/valet-plus/cli/stubs/elasticsearch.conf /usr/local/etc/nginx/valet/elasticsearch.conf
```
medium Dangerous commands cmd-privilege references/INSTALLATION_AND_HOSTING_PART2.md:3097

Privilege escalation / world-writable permissions
```
sudo wget https://getcomposer.org/download/latest-stable/composer.phar -O /usr/local/bin/composer
```
medium Dangerous commands cmd-privilege references/INSTALLATION_AND_HOSTING_PART2.md:3098

Privilege escalation / world-writable permissions
```
sudo chmod +x /usr/local/bin/composer
```
medium Dangerous commands cmd-privilege references/INSTALLATION_AND_HOSTING_PART2.md:3110

Privilege escalation / world-writable permissions
```
sudo wget https://getcomposer.org/download/latest-stable/composer.phar -O /usr/local/bin/composer
```
medium Dangerous commands cmd-privilege references/INSTALLATION_AND_HOSTING_PART3.md:349

Privilege escalation / world-writable permissions
```
echo "trusted-users = root ${USER}" | sudo tee -a /etc/nix/nix.conf && sudo pkill nix-daemon
```
medium Dangerous commands cmd-pipe-to-shell references/PRODUCT_EXTENSIONS_OVERVIEW_PART6.md:171

Downloads and executes remote code from an unrecognised host (pipe to shell) (the skill's own vendor host)
```
curl -L https://install.sw-paas-cli.shopware.systems | sh
```
vendor-host
medium Dangerous commands cmd-pipe-to-shell references/PRODUCT_EXTENSIONS_OVERVIEW_PART6.md:179

Downloads and executes remote code from an unrecognised host (pipe to shell) (the skill's own vendor host)
```
curl -L https://install.sw-paas-cli.shopware.systems | sh -s 0.0.30
```
vendor-host
medium Dangerous commands cmd-pipe-to-shell references/PRODUCT_EXTENSIONS_OVERVIEW_PART6.md:360

Downloads and executes remote code from an unrecognised host (pipe to shell) (the skill's own vendor host)
```
curl -L https://install.sw-paas-cli.shopware.systems | sh
```
vendor-host

medium Obfuscation obf-base64-blob references/STOREFRONT_THEMES_TWIG.md:388

Long base64-looking blob

You might want to check out the example [Goog…aV3](https://github.com/shopware/shopware/blob/trunk/src/Storefront/Framework/Captcha/Goog…php) class from the Shopware 6 core. It's

medium Exfiltration net-credential-use references/TOOLING.md:21

Credential used in a network call (verify the destination is the intended service)
```
curl -sS -H "Authorization: Bearer $SHOPWARE_ACCESS_TOKEN" \
```
low Exfiltration exfil-webhook-url references/APP_SYSTEM_PART2.md:139

Webhook / callback URL commonly used for exfiltration (verify the destination) (placeholder value)
```
<url>https://hooks.slack.com/services/{id}</url>
```
placeholder
low Secrets in code secret-high-entropy-token references/CHECKOUT_CART_PAYMENTS.md:1791

High-entropy token-like string (may be an id, hash or a credential)
```
class Migr…ype extends MigrationStep
```
low Secrets in code secret-high-entropy-token references/CHECKOUT_CART_PAYMENTS.md:2084

High-entropy token-like string (may be an id, hash or a credential)
```
class Migr…ent extends MigrationStep
```

low Obfuscation obf-base64-blob references/CHECKOUT_CART_PAYMENTS.md:2256

Long base64-looking blob (quoted — discussed, not commanded)

For this, we're going to use the [PreWriteValidationEvent](https://github.com/shopware/shopware/blob/v6.6.9.0/src/Core/Framework/DataAbstractionLayer/Write/Validation/PreWriteValidationEvent.php), whi

quoted

low Obfuscation obf-base64-blob references/CHECKOUT_CART_PAYMENTS.md:2533

Long base64-looking blob (quoted — discussed, not commanded)

Just one more thing worth noting. There's a [helper class](https://github.com/shopware/shopware/blob/v6.3.4.1/src/Core/Checkout/Order/Aggregate/OrderTransaction/OrderTransactionStateHandler.php) in Sh

quoted

low Secrets in code secret-high-entropy-token references/CMS_AND_CONTENT.md:1086

High-entropy token-like string (may be an id, hash or a credential)
```
class Migr…ate extends MigrationStep
```
low Secrets in code secret-high-entropy-token references/CMS_AND_CONTENT.md:1264

High-entropy token-like string (may be an id, hash or a credential)
```
class Migr…ate extends MigrationStep
```
low Secrets in code secret-high-entropy-token references/CMS_AND_CONTENT.md:1806

High-entropy token-like string (may be an id, hash or a credential)
```
class Migr…Url extends MigrationStep
```
low Exfiltration exfil-webhook-url references/CORE_REFERENCE.md:398

Webhook / callback URL commonly used for exfiltration (verify the destination) (placeholder value)
```
<url>https://hooks.slack.com/services/{id}</url>
```
placeholder
low Secrets in code secret-high-entropy-token references/DAL_AND_DATA.md:346

High-entropy token-like string (may be an id, hash or a credential)
```
class Migr…ion extends MigrationStep
```
low Secrets in code secret-high-entropy-token references/DAL_AND_DATA.md:1192

High-entropy token-like string (may be an id, hash or a credential)
```
class Migr…ion extends MigrationStep
```
low Secrets in code secret-high-entropy-token references/DAL_AND_DATA.md:1994

High-entropy token-like string (may be an id, hash or a credential)
```
class Migr…ble extends MigrationStep
```
low Secrets in code secret-high-entropy-token references/DAL_AND_DATA.md:2207

High-entropy token-like string (may be an id, hash or a credential)
```
class Migr…ion extends MigrationStep
```
low Secrets in code secret-high-entropy-token references/HEADLESS_FRONTENDS_PART2.md:903

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
"fileName": "shop…ash",
```
quoted
low Exfiltration read-dotenv references/INSTALLATION_AND_HOSTING_PART2.md:389

Reads a .env file
```
cp /var/www/shopware_backup/.env.local /var/www/shopware/shared/.env.local
```
low Exfiltration read-dotenv references/INSTALLATION_AND_HOSTING_PART2.md:1255

Reads a .env file
```
cp .env.example .env
```
low Dangerous commands cmd-background-process references/INSTALLATION_AND_HOSTING.md:1701

Starts a background / autostarted process (quoted — discussed, not commanded)
```
`systemctl enable shopware_consumer@{1..3}.service`
```
quoted
low Dangerous commands cmd-background-process references/INSTALLATION_AND_HOSTING.md:1704

Starts a background / autostarted process (detector / deny-list definition; security demo / example)
```
`systemctl enable shopware_consumer.target`
```
detectordemo
low Secrets in code secret-high-entropy-token references/PLUGIN_SYSTEM_PART2.md:1294

High-entropy token-like string (may be an id, hash or a credential)
```
class Migr…ion extends MigrationStep
```
low Secrets in code secret-high-entropy-token references/PLUGIN_SYSTEM_PART2.md:1336

High-entropy token-like string (may be an id, hash or a credential)
```
class Migr…ion extends MigrationStep
```

low Obfuscation obf-base64-blob references/PLUGIN_SYSTEM.md:1561

Long base64-looking blob (quoted — discussed, not commanded)

Let's have a look at an [example code](https://github.com/shopware/shopware/blob/v6.4.0.0/src/Core/Content/Product/SalesChannel/Listing/ResolveCriteriaProductListingRoute.php#L55-L59):

quoted

low Secrets in code secret-high-entropy-token references/PRODUCT_EXTENSIONS_OVERVIEW_PART2.md:2689

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
Configurator extends classes like `Abst…tor` or `Abst…tor` for base or extended migrations, respectively.
```
quoted
low Secrets in code secret-high-entropy-token references/PRODUCT_EXTENSIONS_OVERVIEW_PART2.md:2725

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
* Create a class extending `Shopware\Commercial\B2B\B2BS…ion\Core\Domain\MappingConfigurator\Abst…tor`.
```
quoted
low Secrets in code secret-high-entropy-token references/PRODUCT_EXTENSIONS_OVERVIEW_PART2.md:2738

High-entropy token-like string (may be an id, hash or a credential)
```
class EmployeeManagementMigrationConfigurator extends Abst…tor
```
low Secrets in code secret-high-entropy-token references/PRODUCT_EXTENSIONS_OVERVIEW_PART2.md:2764

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
* `Quot…tor` has a priority of `8000`.
```
quoted
low Secrets in code secret-high-entropy-token references/PRODUCT_EXTENSIONS_OVERVIEW_PART2.md:2845

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
* Create a class extending `Shopware\Commercial\B2B\B2BS…ion\Core\Domain\Extension\ExtensionConfigurator\Abst…tor`.
```
quoted
low Secrets in code secret-high-entropy-token references/PRODUCT_EXTENSIONS_OVERVIEW_PART3.md:2769

High-entropy token-like string (may be an id, hash or a credential)
```
$indexer->generate(\Shop…ass, __DIR__ . '/my-acl-config.php');
```
low Secrets in code secret-high-entropy-token references/PRODUCT_EXTENSIONS_OVERVIEW_PART4.md:2114

High-entropy token-like string (may be an id, hash or a credential)
```
class Shop…ter extends ProductConverter
```
low Secrets in code secret-high-entropy-token references/PRODUCT_EXTENSIONS_OVERVIEW_PART4.md:2930

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
This can be found in the [`Swag\EnterpriseSearch\Migration\Migr…ion`](https://gitlab.com/shopware/shopware/enterprise/swagenterprisesearchplatform/-/blob/releas
```
quoted
low Dangerous commands cmd-background-process references/PRODUCT_EXTENSIONS_OVERVIEW_PART6.md:1838

Starts a background / autostarted process
```
sudo systemctl enable redis-server
```
low Exfiltration read-dotenv references/PRODUCT_EXTENSIONS_OVERVIEW_PART6.md:2107

Reads a .env file
```
cp .env.template .env
```
low Exfiltration read-dotenv references/PRODUCT_EXTENSIONS_OVERVIEW.md:2379

Reads a .env file
```
cat .env
```
low Exfiltration read-dotenv references/PRODUCT_EXTENSIONS_OVERVIEW.md:2868

Reads a .env file
```
cp .env.template .env
```
low Secrets in code secret-high-entropy-token references/SHOPWARE_67_EXAMPLES_PLUGIN_DAL.md:423

High-entropy token-like string (may be an id, hash or a credential) (test fixture / example file)
```
class Migr…ble extends MigrationStep
```
fixture
low Secrets in code secret-high-entropy-token references/STOREFRONT_THEMES_TWIG.md:1325

High-entropy token-like string (may be an id, hash or a credential)
```
class Migr…ing extends MigrationStep
```
low Secrets in code secret-high-entropy-token references/TESTING_AND_QUALITY.md:1626

High-entropy token-like string (may be an id, hash or a credential) (test fixture / example file; quoted — discussed, not commanded)
```
In order to test the example migration `Migr…ion`, create a new test called `Migr…est`, which extends from the PHPUnit `TestCase`. Use the
```
fixturequoted
low Secrets in code secret-high-entropy-token references/TESTING_AND_QUALITY.md:1640

High-entropy token-like string (may be an id, hash or a credential) (test fixture / example file)
```
class Migr…est extends TestCase
```
fixture
low Secrets in code secret-high-entropy-token references/TESTING_AND_QUALITY.md:1650

High-entropy token-like string (may be an id, hash or a credential) (test fixture / example file)
```
$migration = new Migr…ion();
```
fixture
low Secrets in code secret-high-entropy-token references/TESTING_AND_QUALITY.md:1667

High-entropy token-like string (may be an id, hash or a credential) (test fixture / example file)
```
$migration = new Migr…ion();
```
fixture
low Secrets in code secret-high-entropy-token references/TESTING_AND_QUALITY.md:1705

High-entropy token-like string (may be an id, hash or a credential) (test fixture / example file)
```
./vendor/bin/phpunit --configuration="custom/plugins/SwagBasicExample" --filter Migr…est
```
fixture

low Obfuscation obf-base64-blob references/TESTING_AND_QUALITY.md:2914

Long base64-looking blob (test fixture / example file)

Use the `AdminApiContext` to interact with the Shopware Admin API. Here is a simplified example of adding a method to [create a new shipping method](https://github.com/shopware/acceptance-test-suite/b

fixture

Files scanned: 63. Evidence is masked. Grey chips explain why severity was lowered.

Against the Agent Skills spec

warning description-no-when description does not say WHEN to use the skill (no "use when")

Process rating: all ten parameters 49/100

0Result and completion. Does not say what the result is
0Inputs and preconditions. Does not say what the process needs to start
0Progress reporting. Says nothing while it works
20When it triggers. No condition that starts the skill
55Failures and branches. 1 branches
60Tools and files. Uses tools (bash, web) that frontmatter does not declare
85Steps. 25 steps, 2 vague phrases
100Consistency. Name and required fields are in place
100Execution cost. Instruction body is 2105 tokens
100Running it twice. No mutating operations

Everything here is measured from the skill text rather than judged by a model, so the numbers are checkable. A parameter weighs more when it is a more common reason for the process to stall.

Quality signals

+5Description has no quoted example phrases that should trigger the skill
+4Description does not say when NOT to use the skill (false activations)
+3Output format is not stated: the model decides each time
+4No input/output examples
+1No license
+2Single-language instructions
+3Description length 154: enough signal without eating the budget
+4Structure: 9 headings
+3Step-by-step instructions: 25 items
+4Reference files are cited in the instructions (22 of 59)

Quality base 70; lint remarks subtract, signals add up to 100. Result: 72.

External checks

ClawHub: clean

This is a static Shopware documentation skill with some risky operational examples, but its behavior is disclosed, purpose-aligned, and not automatically executable.

LLM: benign (high) · VirusTotal: · 29 May 2026

Tests

— no evals.json

— no spec.yaml

— not run on models

Files · 63

CHANGELOG.md 1K
README.md 2K
references/ADMINISTRATION_UI.md 128K
references/ADMINISTRATION_UI_PART2.md 130K
references/ADMINISTRATION_UI_PART3.md 135K
references/ADMINISTRATION_UI_PART4.md 29K
references/ADMIN_API.md 15K
references/ADMIN_EXTENSION_SDK.md 126K
references/ADR_OVERVIEW.md 63K
references/APPS_VS_PLUGINS_AND_PATHS.md 3K
references/APP_SYSTEM.md 127K
references/APP_SYSTEM_PART2.md 131K
references/APP_SYSTEM_PART3.md 48K
references/AUTH.md 2K
references/CATALOG_AND_SALES_CHANNEL.md 9K
references/CHECKOUT_CART_PAYMENTS.md 133K
references/CMS_AND_CONTENT.md 129K
references/CODE_GUIDELINES_ESSENTIALS.md 8K
references/CONCEPTS_ARCHITECTURE.md 92K
references/CONNECTING.md 2K
references/CORE_REFERENCE.md 133K
references/CORE_REFERENCE_PART2.md 102K
references/DAL_AND_DATA.md 132K
references/DAL_AND_DATA_PART2.md 12K
references/DOC_PORTAL_ROOT.md 35K
references/HEADLESS_FRONTENDS.md 132K
references/HEADLESS_FRONTENDS_PART2.md 134K
references/HEADLESS_FRONTENDS_PART3.md 9K
references/INSTALLATION_AND_HOSTING.md 130K
references/INSTALLATION_AND_HOSTING_PART2.md 130K
references/INSTALLATION_AND_HOSTING_PART3.md 47K
references/INTEGRATIONS_AND_SYNC.md 30K
references/MERCHANT_USER_DOCS.md 2K
references/OPENCLAW_INTEGRATION.md 2K
references/OVERVIEW.md 5K
references/PLATFORM_REPO_AND_CONTRIBUTING.md 2K
references/PLUGIN_SYSTEM.md 135K
references/PLUGIN_SYSTEM_PART2.md 101K
references/PRODUCT_EXTENSIONS_OVERVIEW.md 137K
references/PRODUCT_EXTENSIONS_OVERVIEW_PART2.md 135K
references/PRODUCT_EXTENSIONS_OVERVIEW_PART3.md 136K
references/PRODUCT_EXTENSIONS_OVERVIEW_PART4.md 133K
references/PRODUCT_EXTENSIONS_OVERVIEW_PART5.md 136K
references/PRODUCT_EXTENSIONS_OVERVIEW_PART6.md 85K
references/RELEASE_AND_UPGRADES.md 133K
references/RELEASE_AND_UPGRADES_PART2.md 126K
references/RELEASE_AND_UPGRADES_PART3.md 107K
references/RULES_FLOWS_AUTOMATION.md 62K
references/SAFETY.md 2K
references/SHOPWARE_67_EXAMPLES_PLUGIN_DAL.md 14K
references/SHOPWARE_67_EXAMPLES_STOREFRONT_ADMIN_CMS.md 11K
references/SHOPWARE_67_PRACTICAL_NOTES.md 28K
references/SOURCES_AND_VERSIONS.md 2K
references/STOREFRONT_THEMES_TWIG.md 136K
references/STOREFRONT_THEMES_TWIG_PART2.md 97K
references/STORE_API.md 28K
references/TESTING_AND_QUALITY.md 129K
references/TESTING_AND_QUALITY_PART2.md 134K
references/TESTING_AND_QUALITY_PART3.md 109K
references/TOOLING.md 2K

Frontmatter

metadata: {"version":"1.0.5","openclaw":{"skillKey":"shopware-expert","homepage":"https://developer.shopware.com/","requires":{"an

Dates

In catalog since 22 Mar 2026

Updated in catalog 11 May 2026

First seen here 10 Sept 2026

Last analysis 11 Sept 2026, 02:26 UTC

Last seen in crawl 9 h ago

Score history

Date		Score	Safety	Qual.
10 Sept 2026	F	29	0	72