Skill Amazon Ads Optimizer

Amazon Ads API v3 skill for OpenClaw agents. List profiles, manage Sponsored Products campaigns, view budgets and performance. Works with any advertiser acco...

This skill appears to do exactly what it says: exchange your LWA refresh token for an access token and call Amazon Ads endpoints. Before installing, verify the source (the registry entry has no homepage and owner ID looks opaque). Protect the credentials file (amazon-ads-api.json) — use strict filesystem permissions, avoid committing it to git, or consider using a secret manager or environment-provided secrets instead of a disk file. If you need higher assurance, inspect the included scripts yourself (ads.js is short and readable) and run the tool in an isolated environment (local container or dedicated machine).

Type: OpenClaw Skill Name: skill-amazon-ads-optimizer Version: 1.0.0 The skill is classified as suspicious due to a significant arbitrary file write vulnerability in `scripts/ads.js`. The script uses `fs.writeFileSync` with the `--out` command-line argument, which directly takes a user-provided file path. If an attacker can control the arguments passed to this script (e.g., via prompt injection against the OpenClaw agent), they could write arbitrary data to any file on the system, potentially leading to remote code execution or system compromise. While the stated purpose of saving campaign data is benign, the lack of input sanitization for the output path creates a high-risk exploit vector. All network calls are to legitimate Amazon API endpoints, and there is no evidence of intentional data exfiltration or other malicious behavior.