Skill Amazon Spapi

Amazon SP-API skill for OpenClaw agents. Fetch orders, check FBA inventory, manage listings and pricing. Works with any marketplace and seller account.

This skill appears to do exactly what it claims: interact with Amazon SP-API using LWA credentials stored in a local JSON file. Before installing/running: 1) Review the amazon-sp-api npm package source/version you will install (supply-chain risk). 2) Keep the credential file secure (chmod 600 as recommended) and do not commit it to source control. 3) Note the small metadata inconsistency: the skill uses AMAZON_SPAPI_PATH but the registry metadata does not list any required env vars — ensure you set that env var or place the file at ./amazon-sp-api.json. 4) Only run these scripts from a trusted environment because they have network access to your seller data and can update listings/pricing.

Type: OpenClaw Skill Name: skill-amazon-spapi Version: 1.0.1 The skill bundle is designed to interact with Amazon SP-API, which is its stated purpose. It reads sensitive credentials from a local file (`amazon-sp-api.json`) and performs legitimate API calls. However, the scripts `scripts/inventory.js`, `scripts/listings.js`, and `scripts/orders.js` accept an `--out` argument for writing output files. This argument is not sanitized, making the skill vulnerable to path traversal (e.g., `node scripts/inventory.js --out ../../../tmp/output.json`). While this is a vulnerability that could be exploited by a compromised or poorly designed AI agent, there is no clear evidence of intentional malicious behavior by the skill itself, such as data exfiltration to unauthorized endpoints, persistence mechanisms, or harmful prompt injection attempts.