APIClaw Amazon API

PassAudited by ClawScan on May 1, 2026.

Overview

The provided artifacts describe a coherent instruction-only API reference skill that uses a declared APIClaw key to query APIClaw’s Amazon commerce-data API.

This appears appropriate for an API reference/integration skill. Before installing, make sure you trust APIClaw with the product or market queries you send, keep APICLAW_API_KEY secret, and monitor API usage if calls may consume paid credits.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

API calls may consume the user’s APIClaw quota or credits, and exposing the key could let someone else use the account.

Why it was flagged

The skill requires a bearer-style API credential; this is expected for APIClaw access, but the key authorizes requests under the user’s account.

Skill content

metadata: {"openclaw": {"requires": {"env": ["APICLAW_API_KEY"]}, "primaryEnv": "APICLAW_API_KEY"}}

Recommendation

Use a dedicated API key if possible, store it only as an environment variable, avoid pasting it into chats or logs, and revoke it if exposed.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Search terms, ASINs, categories, or product-research intent provided to the skill may be sent to APIClaw.

Why it was flagged

The skill is designed to send user-selected product, category, ASIN, and review-analysis requests to an external API provider.

Skill content

Base URL: `https://api.apiclaw.io/openapi/v2` ... All endpoints: **POST** with JSON body

Recommendation

Only submit product or market research queries that you are comfortable sharing with APIClaw, and review the provider’s data handling terms if the queries are business-sensitive.