SP-API Skill

Amazon SP-API skill for OpenClaw agents. Fetch orders, check FBA inventory, manage listings and pricing. Works with any marketplace and seller account.

Before installing or using this skill: (1) Verify the skill source and author — the package has no homepage and the registry owner is unknown. (2) Expect to provide highly sensitive Amazon SP-API credentials (LWA client id/secret, refresh token, sellerId, marketplace). Do not paste these into public places. The skill expects them in a local file (amazon-sp-api.json) and optionally referenced by the AMAZON_SPAPI_PATH env var — note that the registry metadata did not declare these secrets. (3) Inspect the included scripts in this bundle (you already have them) and confirm they only call Amazon SP-API and write local output; run them in an isolated environment (container/VM) first. (4) Verify the npm dependency 'amazon-sp-api' comes from a trusted source and pin/check its integrity (use package-lock, checksum, or audit). (5) If you want stricter control, keep the skill user-invocable only and consider disabling autonomous invocation for agents that hold your production credentials. (6) If anything about provenance or the missing credential declaration worries you, do not install or provide credentials until the publisher clarifies why credentials were omitted from metadata.

Type: OpenClaw Skill Name: skill-spapi Version: 1.0.1 The skill is classified as suspicious due to a potential arbitrary file write vulnerability. The scripts `scripts/inventory.js`, `scripts/listings.js`, and `scripts/orders.js` directly use the `--out` command-line argument as a file path for `fs.writeFileSync` without any sanitization or validation. This could allow an attacker, via prompt injection against the OpenClaw agent, to instruct the agent to write arbitrary data to arbitrary file paths on the system, potentially leading to remote code execution or data corruption.