Amazon Ads Reporter

Fetch Amazon Ads Sponsored Products campaign reports asynchronously by requesting and polling separately to avoid API timeouts, with no npm dependencies.

This package mostly does what it says (fetch reports, list bids) but it is inconsistent and incomplete. Before using it: 1) Do not run with real credentials until you verify the missing scripts — SKILL.md references request-report.js, poll-report.js, and get-report.js but only keyword-report.js and get-bids.js are included. 2) Inspect or obtain the missing scripts from a trusted source or ask the author for a complete release. 3) Store credentials carefully: amazon-ads-api.json contains a refresh token and client secret in plaintext — keep it readable only by you and consider using a short-lived profile or limited-scope account. 4) Confirm CAMPAIGN_IDS is set when running get-bids.js and that your Node runtime provides global fetch (or run on a Node version that supports it) or adjust the script. 5) Note that both scripts call Amazon endpoints and do not contact any other external servers — if you see network calls to non-Amazon domains, do not proceed. 6) Because the package metadata didn't declare required env vars, treat the skill as incomplete and verify behavior in a safe/test environment; rotate secrets if you accidentally exposed them during testing.

Type: OpenClaw Skill Name: skill-amazon-ads-reporter Version: 1.1.0 The skill bundle provides legitimate tools for interacting with the Amazon Ads Reporting API v3. The scripts (get-bids.js and keyword-report.js) correctly implement OAuth2 token refreshing and async report polling as per Amazon's documentation. While they access sensitive credentials from a local JSON file (~/amazon-ads-api.json), the data is only transmitted to official Amazon endpoints (api.amazon.com and advertising-api-eu.amazon.com). No malicious execution, data exfiltration to third parties, or prompt injection attempts were found.