Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
AI Amazon Product Dominator — Find Winning Products & Crush the Competition Before You Launch
v1.0.0Scrapes Amazon to identify winning products, analyze competitors, mine negative reviews, calculate profits, craft optimized listings, and create launch videos.
⭐ 0· 56·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The skill claims to perform networked tasks via Apify, InVideo AI, and Claude AI (scraping, video generation, LLM work) but the package declares no required environment variables, API keys, or instructions for authenticating to those services. A legitimate integration would normally require API credentials or an install/usage guide for those services; their absence is inconsistent.
Instruction Scope
SKILL.md is detailed and narrowly focused on Amazon product research, review mining, keyword research and video generation using the listed third‑party services. It does not instruct reading local system files or unrelated environment variables. However, it implicitly requires outbound network calls and automated scraping of Amazon/Reddit which may violate terms of service and could generate significant data collection and API usage.
Install Mechanism
This is instruction‑only (no install spec, no code files). That lowers the risk of arbitrary code being written to disk, but behavior depends entirely on the agent's runtime network calls to external services.
Credentials
No credentials or config paths are declared, yet the workflow relies on Apify, InVideo, and Claude — all of which normally require API keys/accounts. The skill should declare which credentials are needed (and for what). The lack of declared env vars is disproportionate to the described networked functionality and makes it unclear how the skill will operate or which account will be billed/used.
Persistence & Privilege
The skill does not request persistent 'always' inclusion and contains no install steps that modify other skills or global agent configuration. Autonomous invocation is allowed by default (normal) but is not combined with elevated persistence here.
What to consider before installing
This skill describes scraping Amazon, mining reviews, running third‑party scrapers (Apify), using Claude for analysis, and generating videos with InVideo, but it lists no API keys, install steps, or account guidance. Before installing or running it: 1) Confirm which API keys/accounts the skill will use — Apify, InVideo, and Claude normally require credentials; ask the author how they are supplied and which account will be billed. 2) Be aware of legal/ToS risk from automated scraping of Amazon/Reddit and ensure you have permission and appropriate rate limits. 3) Monitor network activity and API usage/costs the first few runs (this skill will perform outbound calls). 4) If you must provide credentials, limit scope (separate service accounts, rate limits, and billing alerts) and avoid reusing high‑privilege keys. 5) Prefer a version that explicitly declares required env vars and shows concrete, auditable API calls instead of implicit/undocumented behavior. Because of the credential/operational mismatch, treat this skill with caution and request clarification from the publisher before trusting it with real accounts or sensitive credentials.Like a lobster shell, security has layers — review code before you run it.
latestvk97d9m0rqy163exh1ymevfv9xh83vxyx
License
MIT-0
Free to use, modify, and redistribute. No attribution required.