← Back to Skills Marketplace
820
Downloads
0
Stars
1
Active Installs
1
Versions
Install in OpenClaw
/install skill-amazon-ads
Description
Amazon Ads API v3 skill for OpenClaw agents. List profiles, manage Sponsored Products campaigns, view budgets and performance. Works with any advertiser acco...
Usage Guidance
This skill appears to do what it says: it uses your LWA client id/secret and refresh token to call Amazon Ads endpoints. Before installing or running it, verify the source (there's no homepage and owner is unverified), review the included script yourself, and avoid pasting long-lived secrets into shared repos. If you must use it, store amazon-ads-api.json with strict filesystem permissions (e.g., chmod 600), set AMAZON_ADS_PATH to a secure path, run the script in a sandbox or isolated environment first, and rotate credentials if you stop trusting the skill. Also consider creating an LWA app with limited permissions and short-lived credentials where possible.
Capability Analysis
Type: OpenClaw Skill
Name: skill-amazon-ads
Version: 1.0.0
The skill provides legitimate functionality for interacting with the Amazon Ads API, handling credentials appropriately and communicating with official Amazon endpoints. However, the `scripts/ads.js` file contains a critical arbitrary file write vulnerability. The `--out` command-line argument is used directly in `fs.writeFileSync(args.out, ...)` without any path sanitization, allowing an attacker to write JSON content to any arbitrary file path on the system. There is no evidence of intentional malicious behavior or prompt injection attempts in the `SKILL.md`.
Capability Assessment
Purpose & Capability
Name/description, SKILL.md, and scripts/ads.js are consistent: the skill implements Amazon Ads API v3 operations and requires node. The credentials and endpoints requested are appropriate for Amazon Ads.
Instruction Scope
Instructions confine actions to reading a local credentials JSON, requesting tokens from https://api.amazon.com, and calling Amazon advertising endpoints; the script may write an output file when --out is used. Note: SKILL.md asks the user to store LWA client secret and refresh token in a plaintext file (amazon-ads-api.json), which is a sensitive practice and should be protected.
Install Mechanism
No install spec is provided (instruction-only), and the only required binary is node. Included script is self-contained and performs network calls; nothing is downloaded from external/personal URLs during install.
Credentials
The skill requests LWA client id/secret, refresh token, profileId and region—these are expected for Amazon Ads use. However, they are stored/read from a local JSON file (unprotected by default). The SKILL.md references an optional AMAZON_ADS_PATH env var but the registry metadata lists no required env vars; this mismatch is minor but worth noting.
Persistence & Privilege
The skill is not always-enabled, does not request persistent platform privileges, and does not modify other skills or agent configs. It runs on-demand (or via normal autonomous invocation) and only reads/writes the credential file and optional output file.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install skill-amazon-ads - After installation, invoke the skill by name or use
/skill-amazon-ads - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release — Sponsored Products campaign management and performance reporting for any Amazon advertiser account
Metadata
Frequently Asked Questions
What is Amazon Ads API?
Amazon Ads API v3 skill for OpenClaw agents. List profiles, manage Sponsored Products campaigns, view budgets and performance. Works with any advertiser acco... It is an AI Agent Skill for Claude Code / OpenClaw, with 820 downloads so far.
How do I install Amazon Ads API?
Run "/install skill-amazon-ads" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Amazon Ads API free?
Yes, Amazon Ads API is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Amazon Ads API support?
Amazon Ads API is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Amazon Ads API?
It is built and maintained by Zero2Ai (@zero2ai-hub); the current version is v1.0.0.
More Skills