Listing Image Optimizer

Audit Amazon product listing images for non-square dimensions, auto-pad them to 2000×2000 white background, and push corrected images to live listings via SP...

This skill appears to implement the advertised pipeline but has a few red flags you should consider before installing and running it: - Sensitive credentials: you must create an SP-API credentials file (refresh token, LWA client id/secret, sellerId). Treat this file like a secret — only place it on machines you control and do not expose it. The skill reads the file from AMAZON_SPAPI_PATH or ./amazon-sp-api.json; metadata did not declare this, so double-check before running. - Public HTTP server: push_images.js serves image files on 0.0.0.0 and advertises a public URL for Amazon to crawl. This will expose any files in the directory at that port while the server is running — consider using a trusted public hosting option (S3 with pre-signed URLs or a secure proxy) instead of opening a host/port on a VPS. - Missing file: SKILL.md documents a fix_title.js command but that file is not included. Expect incomplete/rough edges; review the scripts locally before use. - Verify dependencies: npm package amazon-sp-api and pip Pillow will be installed locally. Inspect package versions and consider running in an isolated environment (container or VM). - Best practices: run first on a test account, rotate/revoke SP-API tokens if you suspect exposure, and audit logs and network access. If you are uncomfortable exposing a public port, adapt the code to upload fixed images to S3 and use S3 URLs for SP-API updates instead of a local server.

Type: OpenClaw Skill Name: skill-listing-optimizer Version: 1.0.1 The skill bundle is classified as suspicious primarily due to the `scripts/push_images.js` file. This script initiates a temporary HTTP server on a public IP address (`0.0.0.0`) to serve image files, which Amazon's SP-API is instructed to crawl. While this functionality is described as necessary for the skill's stated purpose of updating Amazon listings, exposing a local directory via a publicly accessible HTTP server, even temporarily and for specific files, introduces a significant security risk. If the agent were to be prompted to use a sensitive directory for this server, it could lead to unauthorized data exposure. The `SKILL.md` also explicitly highlights the requirement for a publicly accessible IP/port for this operation.