← 返回 Skills 市场

Skill Amazon Review Request

Name: Skill Amazon Review Request
Author: zero2ai-hub

作者 Zero2Ai · GitHub ↗ · v1.0.0

cross-platform ⚠ suspicious

320

总下载

当前安装

版本数

在 OpenClaw 中安装

/install skill-amazon-review-request

功能描述

Sends Amazon review requests for eligible shipped orders using SP-API with retry, deduplication, eligibility checks, and optional dry-run mode.

使用说明 (SKILL.md)

skill-amazon-review-request

Sends Amazon review requests for eligible Shipped orders via SP-API Messaging API. Hardened with retry logic, deduplication, eligibility window enforcement, and dry-run mode.

Prerequisites

SP-API credentials in ~/amazon-sp-api.json:

{
  "refreshToken": "...",
  "clientId": "...",
  "clientSecret": "...",
  "marketplaceId": "A2VIGQ35RCS4UG"
}

Or set env vars: SP_API_REFRESH_TOKEN, SP_API_CLIENT_ID, SP_API_CLIENT_SECRET, SP_API_MARKETPLACE_ID
SP-API app must have Messaging permission granted

Usage

# Dry run — see what would be sent (no requests made)
node scripts/request-reviews.js --dry-run

# Live run
node scripts/request-reviews.js

Behavior

Feature	Detail
Eligibility window	Orders 5–30 days old only (Amazon's allowed window)
Deduplication	Skips orders already logged as `sent` in the tracking log
Retry logic	Up to 3 attempts with 5s delay on 5xx / 429 responses
Rate limiting	1.1s pause between requests
Dry-run	`--dry-run` flag — logs what would be sent, no API calls
Tracking log	`data/review-requests-log.json` — per-order status, sentAt, attempts
Text log	`data/review-requests.log` — timestamped human-readable run log

Tracking Log Schema

data/review-requests-log.json:

[
  {
    "orderId": "123-4567890-1234567",
    "sentAt": "2026-03-01T10:00:00.000Z",
    "status": "sent",       // "sent" | "failed" | "skipped"
    "attempts": 1,
    "reason": "optional error string for failed/skipped"
  }
]

Summary Output

=== DONE | Sent: 12 | Skipped: 4 | Failed: 1 ===

Dry-run:

=== DONE [DRY RUN] | Would send: 15 | Skipped: 4 ===

Scheduling (Recommended)

Run daily via cron:

# 9am UAE time (UTC+4) = 5am UTC
0 5 * * * cd $HOME/.openclaw/workspace && node skills/skill-amazon-review-request/scripts/request-reviews.js >> data/review-requests-cron.log 2>&1

Region Note

Script targets sellingpartnerapi-eu.amazon.com (EU endpoint, covers UAE marketplace). Change to sellingpartnerapi-na.amazon.com or sellingpartnerapi-fe.amazon.com for other regions.

安全使用建议

Do not install or enable this skill until the author fixes the manifest to declare the sensitive credentials it needs. Specifically: (1) confirm the author adds required env vars (SP_API_REFRESH_TOKEN, SP_API_CLIENT_ID, SP_API_CLIENT_SECRET, SP_API_MARKETPLACE_ID) or documents SP_API_PATH in the registry metadata; (2) confirm whether Supabase integration is optional and, if used, what data is sent to the Supabase instance (URL/key are sensitive); (3) inspect the script locally and run --dry-run first in an isolated environment to verify behavior; (4) avoid placing credentials in world-readable files — prefer environment variables or a secure secret store; and (5) if you plan to schedule it via cron, run it under a dedicated, minimal-permission account and monitor network activity. The mismatch between the manifest and runtime requirements is the main red flag — once corrected and documented, the skill appears coherent with its stated purpose.

功能分析

Type: OpenClaw Skill Name: skill-amazon-review-request Version: 1.0.0 The skill bundle is designed to send Amazon review requests and includes features like retry logic, deduplication, and optional logging to a user-configured Supabase instance. While the script accesses API credentials from the user's home directory or environment variables and performs network calls to Amazon SP-API and the specified Supabase endpoint, these actions are directly aligned with its stated purpose. The data sent to Supabase (order IDs, ASINs, status, errors) is operational logging, not sensitive system secrets. The `SKILL.md` instructions are clear and do not contain any prompt injection attempts or instructions for unauthorized actions. All observed behaviors are plausibly needed for the skill's functionality, and there is no evidence of intentional harmful behavior.

能力评估

⚠ Purpose & Capability

The skill's stated purpose is to send SP-API review requests, and the script requires SP-API credentials (refresh token, client id/secret, marketplace id) and optionally Supabase credentials. However the registry metadata declares no required environment variables or primary credential. That mismatch is problematic: a user would reasonably expect the manifest to declare the sensitive credentials this skill needs.

⚠ Instruction Scope

SKILL.md and scripts instruct the agent to read ~/amazon-sp-api.json (or SP_API_* env vars), and optionally ~/supabase-api.json (or SUPABASE_API_PATH). The runtime instructions also write logs under data/ and suggest a cron that runs the script from the workspace. These behaviors are coherent with the stated purpose, but the instructions reference filesystem paths and optional external (Supabase) endpoints that are not declared in the manifest — that gap should be fixed. The script performs network calls to Amazon endpoints and, if configured, to a Supabase REST endpoint.

✓ Install Mechanism

This is an instruction-only skill with a single shipped script and no install specification. That is low risk from a packaging/install perspective because nothing is downloaded or extracted during install. The code will run when executed, so runtime behavior should be reviewed (which was done).

⚠ Credentials

The script requires highly sensitive credentials (SP_API refresh token, client id/secret, marketplace id) and may use a Supabase URL/key. Those credentials are proportionate to the stated task, but the manifest does not declare them. The absence of declared required env vars / primary credential makes permission review and least-privilege reasoning impossible for an installer.

✓ Persistence & Privilege

The skill does not request always: true or other elevated platform privileges, and it does not modify other skills. It writes local logs/tracking files under data/, which is expected for its function.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install skill-amazon-review-request
安装完成后，直接呼叫该 Skill 的名称或使用 /skill-amazon-review-request 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

- Initial release of skill-amazon-review-request. - Sends Amazon review requests for eligible shipped orders using the SP-API Messaging API. - Includes retry logic, deduplication, eligibility window enforcement (5–30 days old), and dry-run mode. - Provides tracking and text logs for transparency and troubleshooting. - Simple CLI usage with options for dry runs and live requests. - Designed for easy daily scheduling via cron.

元数据

Slug skill-amazon-review-request

版本 1.0.0

许可证 —

累计安装 1

当前安装数 1

历史版本数 1

常见问题