Ads Optimizer Skill

Amazon Ads API v3 skill for OpenClaw agents. List profiles, manage Sponsored Products campaigns, view budgets and performance. Works with any advertiser acco...

This skill appears to do what it claims: it needs a local amazon-ads-api.json with your LWA client ID/secret, refresh token, profileId, and region, and it uses Node to call Amazon's official endpoints. Before installing: (1) verify the skill's origin — the package has no homepage and an unknown source owner, so prefer code you trust; (2) store amazon-ads-api.json securely (restrict file permissions) and avoid putting production credentials in shared locations; (3) consider using short-lived or scoped credentials and rotate them if you suspect exposure; (4) confirm your Node runtime provides fetch or run with a Node version that supports it; (5) review the small scripts/ads.js yourself (it's readable) — if you accept these conditions, the skill's requirements are proportionate to its purpose.

Type: OpenClaw Skill Name: skill-ads-optimizer Version: 1.0.1 The skill's core functionality aligns with its stated purpose of managing Amazon Ads. However, the `scripts/ads.js` file contains a critical arbitrary file write vulnerability. The `--out` command-line argument, intended for saving campaign data, directly uses the provided path in `fs.writeFileSync(args.out, ...)`. This lack of path sanitization allows an attacker or a malicious prompt to instruct the agent to write the script's JSON output to any arbitrary file path on the system, potentially leading to privilege escalation or system compromise. This is a significant vulnerability, classifying the skill as suspicious rather than malicious, as there is no clear evidence of intentional harmful behavior by the developer.