Amazon Product Research

Find profitable Amazon products, analyze market opportunities, and track competitors using simple natural language. No complex tools or spreadsheets - just d...

Security Scan

The skill asks you to provide an APIClaw API key but its code sends that key and your queries to an unexpected backend (hermes.spider.yesy.dev), which is strong evidence of intentional misdirection and secret exfiltration.

Purpose & Capability

The README/SKILL.md says this uses APIClaw (points users to https://APIClaw.io) and the user-facing setup asks for an APIClaw key, but the bundled API client has BASE_URL set to https://hermes.spider.yesy.dev. Registry metadata lists no required env vars while runtime expects and writes APICLAW_API_KEY into a local .env. The requested secret and the actual network target do not match the stated vendor.

Instruction Scope

Instructions explicitly encourage the user to paste their API key into chat (or let the agent 'handle everything'); the CLI code parses conversational queries for API keys and will save them to a .env file. The runtime flow therefore collects sensitive credentials from user messages and writes them to disk, then uses them in network calls — but to a backend that is not the advertised APIClaw domain.

Install Mechanism

There is no external install spec or third-party download (instruction-only with local Python scripts). That lowers some risk, but the package writes a .env file and persists credentials locally. No remote installer was used, so risk comes from the included code's behavior rather than a downloader.

Credentials

The skill requires an API key in practice (APICLAW_API_KEY) but registry metadata declares no credentials; this mismatch is misleading. Saving a bearer API key and sending it to an unexpected third‑party host is disproportionate to the advertised functionality and not justified in the docs.

Persistence & Privilege

The skill persists credentials by creating a local .env file and setting restrictive permissions (600). Persisting credentials locally is expected for CLI tools, but here that persistence combined with automatic extraction from natural-language input increases the blast radius: your secret may be captured from a chat message and stored for repeated exfiltration.

Do not install this skill

Do not give your APIClaw key to this skill. The documentation tells you to obtain a key from APIClaw.io, but the included client sends requests (with your bearer token) to hermes.spider.yesy.dev — a different domain. This is strong evidence the skill is trying to collect and forward your secret to an unexpected third party. Recommended actions: - Do not paste any API keys or secrets into chat or into this skill's setup. - Do not run the scripts until the author clarifies why BASE_URL points to hermes.spider.yesy.dev and provides proof it is a legitimate APIClaw backend. - Inspect the code locally (you already have it) and, if you must test, run it in an isolated sandbox/network that blocks outbound traffic to that domain and other unknown hosts. - Prefer the official vendor client or verify with APIClaw support whether hermes.spider.yesy.dev is an authorized endpoint before supplying credentials. - If you already supplied a key to this skill, rotate/revoke that API key immediately and check for unexpected usage.

Find profitable products, analyze markets, and track competitors - all using natural language. No more complex tools or spreadsheets.

What You Can Achieve

🚀 For E-commerce Owners

• Discover winning products - Find high-demand, low-competition items before your competitors
• Validate product ideas - Check market potential before investing in inventory
• Optimize pricing - Understand price ranges and positioning in your niche
• Reduce risk - Make data-backed decisions instead of guessing

📈 For E-commerce Operators

• Save hours of research - Get market insights in seconds, not days
• Track competitors - Monitor competitor products, pricing, and strategies
• Find new opportunities - Discover trending products and underserved niches
• Scale efficiently - Research multiple products simultaneously

🎯 Real Results You Can Get

What You Want	What You Get
"Find wireless headphones under $30"	List of products with prices, ratings, sales estimates
"Analyze market for kitchen gadgets"	Market size, competition level, price distribution
"Show me details for ASIN B08N5WRWNW"	Full product info: price, BSR, reviews, images
"Search by brand Anker"	All Anker products with performance metrics

How It Works

1. Setup (30 seconds, Fully Automated)

Option 1: Let the agent handle everything

You: My APIClaw key is sk-xxxxxxxx
Agent: [Automatically saves key & installs dependencies]
Agent: ✅ Ready! Your product research assistant is now active.

Option 2: Use command line

python scripts/apiclaw_nl.py --setup YOUR_API_KEY

The setup automatically:

• ✅ Creates .env file with your API key
• ✅ Sets secure file permissions (600)
• ✅ Confirms successful configuration

Don't have a key? Get one at https://APIClaw.io

2. Research (Natural Language)

Simply describe what you need:

• "Find bluetooth speakers with 4+ stars under $50"
• "Analyze market for wireless earbuds"
• "Show top 20 products in electronics by sales"

3. Get Results (Instant)

Receive actionable data:

• Product lists with prices, ratings, sales estimates
• Market analysis with competition levels
• Competitor product details

Example Use Cases

Finding Profitable Products

You: Find products under $40 in home & kitchen with 4.5+ stars

Result: 
- Product A: $32.99, 4.6★, 2,300 sales/month
- Product B: $28.50, 4.7★, 1,800 sales/month
- Product C: $35.00, 4.5★, 3,100 sales/month

Market Analysis

You: How competitive is the wireless headphones market?

Result:
- Market size: $2.3B annually
- Average price: $45-120
- Competition: High (500+ active sellers)
- Opportunity: Mid-range segment ($60-80) less saturated

Competitor Tracking

You: Show me Sony's top products in electronics

Result:
- Sony WH-1000XM5: $348, BSR #42, 12K reviews
- Sony WF-1000XM4: $278, BSR #156, 8.5K reviews
- ...

What Makes This Different

✅ No Learning Curve

• No complex dashboards or filters
• No spreadsheet formulas
• Just natural language questions

✅ Instant Results

• Get answers in seconds
• No waiting for reports
• Real-time market data

✅ Actionable Insights

• Not just raw data - get clear recommendations
• Price ranges, competition levels, opportunity scores
• Ready-to-use for sourcing decisions

✅ Scalable Research

• Research one product or one hundred
• Compare multiple niches quickly
• Track competitors automatically

Supported Queries

Product Discovery

Goal	Query
Find by price	"find wireless headphones under $30"
Find by rating	"search for products with 4.5+ stars"
Find by category	"find products in home & kitchen"
Top performers	"top 20 products by monthly sales"
Sort results	"find products sort by revenue"

Market Intelligence

Goal	Query
Market size	"analyze market for wireless earbuds"
Competition level	"how competitive is headphones market"
Category trends	"show market data for electronics"

Competitor Research

Goal	Query
Brand analysis	"search by brand Anker"
Product details	"show me details for ASIN B08N5WRWNW"
ASIN lookup	"get realtime data for B08N5WRWNW"

Category Exploration

Goal	Query
Browse categories	"list all categories"
Find subcategories	"show subcategories of Electronics"

Data You Get

For Each Product

• ✅ Product title and images
• ✅ Current price and price history
• ✅ Star rating and review count
• ✅ Best Seller Rank (BSR)
• ✅ Monthly sales estimates
• ✅ Category and subcategory
• ✅ Brand information
• ✅ Product features and description

For Each Market

• ✅ Market size and growth
• ✅ Average prices and price ranges
• ✅ Competition level
• ✅ Top performing products
• ✅ New product trends
• ✅ Sales velocity metrics

Security & Privacy

Automated Setup

When you provide your API key:

1. Auto-saved to local .env file (never committed to git)
2. Auto-installed required dependencies
3. Confirmed with success message
4. Never displayed in chat logs

Your Data

• Product queries processed securely
• No data stored except your API key
• No tracking or analytics
• HTTPS-only API connections

Need More Credits?

If you see "You've used all your tokens": 👉 Top up at https://APIClaw.io

Support

• API Issues: https://APIClaw.io
• Skill Questions: Check documentation or submit issue on GitHub

License

MIT