Amazon Listing Image Optimizer

Audit Amazon product listing images for non-square dimensions, auto-pad them to 2000×2000 white background, and push corrected images to live listings via SP...

This package appears to implement the advertised workflow, but there are three things to check before installing or giving it credentials: 1) Credentials: The tool requires Amazon SP‑API credentials (LWA client id/secret and a refresh token) via a JSON file pointed to by AMAZON_SPAPI_PATH, but the package metadata does not declare these requirements — treat that as a red flag and only provide such credentials to code you fully trust. Those credentials can modify listings, so limit their scope and revoke them if you stop using the tool. 2) Public HTTP server: push_images.js binds an HTTP server to 0.0.0.0 and exposes files from the specified directory for ~15 minutes so Amazon can crawl them. Run this in a locked-down environment (dedicated VM/VPS), ensure the served directory contains only the intended image files, restrict network access (firewall, allowlist), or prefer uploading images to S3 and providing pre-signed URLs instead. 3) Packaging inconsistencies: SKILL.md references fix_title.js but that file is missing from the bundle; metadata doesn't list required env vars. Review the included scripts manually (they are short) to ensure there is no hidden exfiltration or unrelated file access. If the maintainer can update metadata to declare required credentials and fix the missing file, and you validate the code, the skill would be more trustworthy. If you are not comfortable providing SP‑API credentials or exposing a public port, do not install or run this skill. If you proceed, do so in an isolated environment and rotate/revoke credentials afterward.

Type: OpenClaw Skill Name: skill-listing-image-optimizer Version: 1.0.0 The skill is classified as suspicious due to a significant path traversal vulnerability in `scripts/push_images.js`. This script starts a local HTTP server on a publicly accessible port (`0.0.0.0:8899`) to serve images to Amazon's crawlers. The server's file path construction (`path.join(dir, req.url.replace(/^//, ''))`) is vulnerable to path traversal, potentially allowing an attacker to read arbitrary files from the host system if the server's IP and port are discovered. While the public server is plausibly needed for the stated purpose, this vulnerability, combined with the broad network exposure, poses a high risk of information disclosure. The skill also handles sensitive Amazon SP-API credentials and makes external network calls, but these actions are aligned with its stated purpose and lack clear malicious intent.