Real-time Amazon Data
v1.0.0Retrieve Amazon product data including pricing, reviews, sales estimates, stock levels, search results, deals, and more via the Canopy API REST endpoints usi...
⭐ 2· 1.2k·3 current·3 all-time
by@rhino88
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description align with the instructions: the SKILL.md documents calls to Canopy's Amazon-data REST endpoints and lists relevant endpoints and parameters. The functionality requested (product, reviews, sales, stock, search, deals) is consistent with a Canopy-type API and does not ask for unrelated capabilities (cloud provider credentials, local filesystem access, etc.).
Instruction Scope
Instructions are narrowly scoped to making HTTPS requests to https://rest.canopyapi.co and handling responses in Python. The SKILL.md does not instruct the agent to read unrelated files, access other environment variables, or transmit data to third parties beyond the documented API host.
Install Mechanism
This is an instruction-only skill with no install spec and no code files, so nothing is written to disk by an installer. That lowers installation risk.
Credentials
The SKILL.md requires an API key (export API_KEY and use it as the API-KEY header), but the registry metadata lists no required environment variables and no primary credential. This mismatch is problematic: the skill needs a secret but the registry doesn't declare it. Also, the env var name used (API_KEY) is generic and may collide with other integrations; best practice would be a specific name (e.g., CANOPY_API_KEY) and the registry should declare it as the primary credential.
Persistence & Privilege
The skill does not request always:true and is user-invocable; it does not attempt to modify other skills or agent-wide settings. Autonomous invocation is allowed (platform default) but this skill does not request elevated persistence.
What to consider before installing
This skill appears to do what it says (call Canopy's Amazon endpoints), but the package metadata failed to declare the required API key. Before installing: 1) Verify the provider URL (https://canopyapi.co) and read Canopy's docs and privacy policy. 2) Ask the skill author or registry to declare the required credential (recommended primaryEnv like CANOPY_API_KEY) so the platform can manage the secret properly. 3) Use a scoped or read-only API key if possible, and avoid reusing high-privilege keys. 4) Be aware the agent will make outbound HTTPS requests to canopyapi.co; do not expose other sensitive data in those requests. 5) If you proceed, test with a limited key and rotate it if anything seems off.Like a lobster shell, security has layers — review code before you run it.
latestvk9745de9v94ksjy0q7wjtbgyqx819r3f
License
MIT-0
Free to use, modify, and redistribute. No attribution required.