Create a WordPress plugin that detects Amazon affiliate links, extracts ASINs, displays product ads with caching, admin settings, and Gutenberg block support.

This package contains frontend assets, block JavaScript, CSS and detailed specs, but it lacks the main PHP/server-side implementation the plugin promises. Before installing or running any generated plugin on a live site: (1) insist on or review the generated PHP files and includes (ad-symbiont.php, class-ads.php, class-link-detector.php, class-paapi.php) so you can verify sanitization, escaping, capability checks, and nonce handling; (2) confirm PA-API credential handling never logs or transmits keys to external endpoints and that AWS Signature V4 is implemented correctly client-side only when needed; (3) test the plugin on a staging site to ensure AJAX handlers (e.g., cache-clear) enforce nonces and manage capabilities; (4) verify affiliate tag behavior to avoid cloaking/link-masking that would violate policies; and (5) if you rely on the agent to generate missing backend code, request a full code review of the generated PHP before deployment. The package as-is is incomplete — treat it as a scaffold, not a ready-to-install plugin.

Type: OpenClaw Skill Name: build-amazon-affiliate-plugin Version: 1.0.0 The skill bundle is classified as benign. The `SKILL.md` provides clear instructions for the AI agent to generate a WordPress plugin, including a standard file output path within the agent's workspace. The JavaScript assets are typical for a WordPress Gutenberg block, and the `package-lock.json` lists common development dependencies without indicating malicious runtime behavior. Furthermore, the `PLUGIN_SPEC.md` explicitly outlines robust security requirements like input sanitization, output escaping, and nonce usage, demonstrating an intent for secure development rather than malice.