ops-ecom

SUSPICIOUS. Core Shopify/ShipBob API usage is coherent, but the setup flow is far too invasive: it instructs the agent to hunt for credentials across password managers, keychain, browser history, shell configs, Doppler projects, and project .env files before asking the user. That scope is disproportionate to a commerce dashboard and creates high risk of unnecessary secret exposure, even though network destinations are mostly official vendor APIs.