Amazon After Sales Flow Luoqianchenguni Max

Automates Amazon after-sales by opening orders, accessing details, running contact flow, and drafting or sending seller messages with explicit confirmation.

Security Scan

The package broadly matches an Amazon after‑sales automation purpose, but there are inconsistencies (claims to be instruction‑only while shipping runnable JS code and a large runtime blob) and there is a nontrivial local install/runtime footprint that could access sensitive browser DOM and save artifacts — review the shipped code before use.

Purpose & Capability

The declared purpose (automating Amazon after‑sales: open orders, fetch details, run contact flows, draft/send messages) is consistent with the shipped skill descriptors (many small browser/dom-focused skills) and the package.json dependency on Playwright. However the metadata said 'instruction-only' while README and shipped files indicate this package is NOT instruction-only and contains runnable JS (and duplicated .py stubs). That mismatch between registry metadata and the actual artifact set is unexpected and should be explained by the author.

Instruction Scope

SKILL.md and the dist skill JSONs explicitly instruct reading Amazon page DOMs, opening orders, drafting messages, and optionally sending them with explicit confirmations. This scope is appropriate for the described automation, but it necessarily accesses sensitive personal data in the active browser session (orders, messages, order IDs, prices). The skill also saves local artifacts (screenshots/DOM) to the workspace. The SKILL.md claims 'No external upload endpoint is configured by default', but you should verify the runtime code (_easybuy_browser_runtime.js) for any network/upload calls before running.

Install Mechanism

There is no platform install spec, but the package expects you to run 'npm install' and 'npx playwright install chromium' (package.json depends on playwright; package-lock points to npm registry). This is a standard but heavyweight install (Playwright + browser binaries). Because the project ships a ~64KB runtime JS file, the package is not truly instruction-only — that larger artifact should be reviewed prior to installation/execution. No unusual or remote download URLs were observed in the provided manifests.

Credentials

The skill requests no environment variables, credentials, or config paths — appropriate because it operates within an active Playwright browser session and relies on the user's existing Amazon login. There are no declared unrelated credentials. Note that DOM access necessarily exposes personal order/messaging data from the user's browser.

Persistence & Privilege

always:false (not force‑installed) and autonomous invocation is allowed (default). The skill may write artifacts to its workspace, which is expected for evidence/screenshot export. It does not request elevated platform privileges nor claim to modify other skills or system-wide agent settings.

What to consider before installing

This package appears to implement the described Amazon after‑sales automation and uses Playwright (so you'll need to run npm install and install Chromium). However: (1) the registry/metadata claims 'instruction-only' while the bundle contains runnable JS (including a large _easybuy_browser_runtime.js) — that inconsistency is concerning and worth asking the author to explain; (2) the runtime will read Amazon order and messaging DOM (sensitive data) and can save local artifacts — inspect the code for any network/upload calls before running; (3) run the package in an isolated/test environment (not your primary profile) and verify the send gating (auto_send + confirm_send) manually; and (4) if you lack the ability to audit the runtime JS, avoid running it against an account with real personal data or funds until you can review the code or get assurances from the author.

Amazon After-Sales Flow

Playwright-based Amazon after-sales automation with explicit send confirmation.

Runtime Requirements

This skill requires a JS runtime and Playwright binaries.

Required environment:

• Node.js >= 18
• npm dependencies installed
• Playwright Chromium installed

Expected setup before use:

• npm install
• npx playwright install chromium

Full-Flow Behavior

1. Open Amazon orders page (year from input when provided).
2. Find an order and open order details.
3. Run contact flow chain.
4. Type message and only send if explicitly confirmed.

Input Modes

1. Natural language:

• run amazon-after-sales-flow 2025
• execute amazon-after-sales-flow 2025

2. JSON actions:

• {"action":"run_full_flow", ...}
• {"action":"open_orders", ...}
• {"action":"run_contact_flow", ...}
• {"skill":"amazon_contact_flow","args":{...}}

Safety And Data Handling

• Legacy shell URL opener is removed.
• URL-only free text input is blocked.
• Sending requires both auto_send=true and confirm_send=true.
• The runtime can read page DOM on Amazon order/messaging pages to complete the workflow.
• Local artifacts may be stored in workspace files.
• No external upload endpoint is configured by default in this package.

Output

Returns runtime JSON traces/results for executed actions.