← Back to Skills Marketplace
320
Downloads
0
Stars
1
Active Installs
1
Versions
Install in OpenClaw
/install skill-amazon-review-request
Description
Sends Amazon review requests for eligible shipped orders using SP-API with retry, deduplication, eligibility checks, and optional dry-run mode.
README (SKILL.md)
skill-amazon-review-request
Sends Amazon review requests for eligible Shipped orders via SP-API Messaging API. Hardened with retry logic, deduplication, eligibility window enforcement, and dry-run mode.
Prerequisites
- SP-API credentials in
~/amazon-sp-api.json:{ "refreshToken": "...", "clientId": "...", "clientSecret": "...", "marketplaceId": "A2VIGQ35RCS4UG" } - Or set env vars:
SP_API_REFRESH_TOKEN,SP_API_CLIENT_ID,SP_API_CLIENT_SECRET,SP_API_MARKETPLACE_ID - SP-API app must have Messaging permission granted
Usage
# Dry run — see what would be sent (no requests made)
node scripts/request-reviews.js --dry-run
# Live run
node scripts/request-reviews.js
Behavior
| Feature | Detail |
|---|---|
| Eligibility window | Orders 5–30 days old only (Amazon's allowed window) |
| Deduplication | Skips orders already logged as sent in the tracking log |
| Retry logic | Up to 3 attempts with 5s delay on 5xx / 429 responses |
| Rate limiting | 1.1s pause between requests |
| Dry-run | --dry-run flag — logs what would be sent, no API calls |
| Tracking log | data/review-requests-log.json — per-order status, sentAt, attempts |
| Text log | data/review-requests.log — timestamped human-readable run log |
Tracking Log Schema
data/review-requests-log.json:
[
{
"orderId": "123-4567890-1234567",
"sentAt": "2026-03-01T10:00:00.000Z",
"status": "sent", // "sent" | "failed" | "skipped"
"attempts": 1,
"reason": "optional error string for failed/skipped"
}
]
Summary Output
=== DONE | Sent: 12 | Skipped: 4 | Failed: 1 ===
Dry-run:
=== DONE [DRY RUN] | Would send: 15 | Skipped: 4 ===
Scheduling (Recommended)
Run daily via cron:
# 9am UAE time (UTC+4) = 5am UTC
0 5 * * * cd $HOME/.openclaw/workspace && node skills/skill-amazon-review-request/scripts/request-reviews.js >> data/review-requests-cron.log 2>&1
Region Note
Script targets sellingpartnerapi-eu.amazon.com (EU endpoint, covers UAE marketplace).
Change to sellingpartnerapi-na.amazon.com or sellingpartnerapi-fe.amazon.com for other regions.
Usage Guidance
Do not install or enable this skill until the author fixes the manifest to declare the sensitive credentials it needs. Specifically: (1) confirm the author adds required env vars (SP_API_REFRESH_TOKEN, SP_API_CLIENT_ID, SP_API_CLIENT_SECRET, SP_API_MARKETPLACE_ID) or documents SP_API_PATH in the registry metadata; (2) confirm whether Supabase integration is optional and, if used, what data is sent to the Supabase instance (URL/key are sensitive); (3) inspect the script locally and run --dry-run first in an isolated environment to verify behavior; (4) avoid placing credentials in world-readable files — prefer environment variables or a secure secret store; and (5) if you plan to schedule it via cron, run it under a dedicated, minimal-permission account and monitor network activity. The mismatch between the manifest and runtime requirements is the main red flag — once corrected and documented, the skill appears coherent with its stated purpose.
Capability Analysis
Type: OpenClaw Skill
Name: skill-amazon-review-request
Version: 1.0.0
The skill bundle is designed to send Amazon review requests and includes features like retry logic, deduplication, and optional logging to a user-configured Supabase instance. While the script accesses API credentials from the user's home directory or environment variables and performs network calls to Amazon SP-API and the specified Supabase endpoint, these actions are directly aligned with its stated purpose. The data sent to Supabase (order IDs, ASINs, status, errors) is operational logging, not sensitive system secrets. The `SKILL.md` instructions are clear and do not contain any prompt injection attempts or instructions for unauthorized actions. All observed behaviors are plausibly needed for the skill's functionality, and there is no evidence of intentional harmful behavior.
Capability Assessment
Purpose & Capability
The skill's stated purpose is to send SP-API review requests, and the script requires SP-API credentials (refresh token, client id/secret, marketplace id) and optionally Supabase credentials. However the registry metadata declares no required environment variables or primary credential. That mismatch is problematic: a user would reasonably expect the manifest to declare the sensitive credentials this skill needs.
Instruction Scope
SKILL.md and scripts instruct the agent to read ~/amazon-sp-api.json (or SP_API_* env vars), and optionally ~/supabase-api.json (or SUPABASE_API_PATH). The runtime instructions also write logs under data/ and suggest a cron that runs the script from the workspace. These behaviors are coherent with the stated purpose, but the instructions reference filesystem paths and optional external (Supabase) endpoints that are not declared in the manifest — that gap should be fixed. The script performs network calls to Amazon endpoints and, if configured, to a Supabase REST endpoint.
Install Mechanism
This is an instruction-only skill with a single shipped script and no install specification. That is low risk from a packaging/install perspective because nothing is downloaded or extracted during install. The code will run when executed, so runtime behavior should be reviewed (which was done).
Credentials
The script requires highly sensitive credentials (SP_API refresh token, client id/secret, marketplace id) and may use a Supabase URL/key. Those credentials are proportionate to the stated task, but the manifest does not declare them. The absence of declared required env vars / primary credential makes permission review and least-privilege reasoning impossible for an installer.
Persistence & Privilege
The skill does not request always: true or other elevated platform privileges, and it does not modify other skills. It writes local logs/tracking files under data/, which is expected for its function.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install skill-amazon-review-request - After installation, invoke the skill by name or use
/skill-amazon-review-request - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
- Initial release of skill-amazon-review-request.
- Sends Amazon review requests for eligible shipped orders using the SP-API Messaging API.
- Includes retry logic, deduplication, eligibility window enforcement (5–30 days old), and dry-run mode.
- Provides tracking and text logs for transparency and troubleshooting.
- Simple CLI usage with options for dry runs and live requests.
- Designed for easy daily scheduling via cron.
Metadata
Frequently Asked Questions
What is Skill Amazon Review Request?
Sends Amazon review requests for eligible shipped orders using SP-API with retry, deduplication, eligibility checks, and optional dry-run mode. It is an AI Agent Skill for Claude Code / OpenClaw, with 320 downloads so far.
How do I install Skill Amazon Review Request?
Run "/install skill-amazon-review-request" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Skill Amazon Review Request free?
Yes, Skill Amazon Review Request is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Skill Amazon Review Request support?
Skill Amazon Review Request is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Skill Amazon Review Request?
It is built and maintained by Zero2Ai (@zero2ai-hub); the current version is v1.0.0.
More Skills