亚马逊评论分析（amazon-review-insights）
v0.9.3亚马逊产品评论智能分析工具，帮助跨境电商卖家进行产品改进、新品开发、市场调研！核心能力：获取亚马逊评论、AI深度分析差评、精准量化高频问题、挖掘高星隐性差评、生成改进建议、追踪评论趋势、增量更新。
⭐ 1· 127·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (Amazon review analysis) matches the actual behavior: the skill calls a CustomerInsights API hosted at api.astrmap.com to create tasks, poll status, and fetch analysis results. The only required environment variable is CUSTOMER_INSIGHTS_API_KEY, which the code uses as a Bearer token for the API—this is appropriate for the described functionality.
Instruction Scope
SKILL.md stays within the stated purpose and documents command usage, required arguments, and user confirmations for paid operations. One notable instruction: the workflow requires a separate '星图' desktop client to be installed and logged into an Amazon buyer account (explicitly telling users not to use a seller account). That is coherent with the stated data-collection method but is a privacy/surface-area consideration: the desktop client will have the capability to access Amazon on the user's behalf, which the user must trust. The skill does not instruct reading unrelated local files or exfiltrating data beyond the astrmap API.
Install Mechanism
There is no install spec (instruction-only skill with a Python helper file). The only Python dependency is requests (requirements.txt). The SKILL.md asks users to pip install -r requirements.txt. There are no downloads from untrusted shorteners or archives in the skill itself. The SKILL.md points users to https://www.astrmap.com/ to obtain a desktop client — that is an external download the user must evaluate separately.
Credentials
The skill requests a single API credential (CUSTOMER_INSIGHTS_API_KEY). The code and docs use that key solely to call the astrmap CustomerInsights API. No unrelated secrets, system credentials, or file paths are requested.
Persistence & Privilege
The skill does not request always:true, does not modify other skills or system-wide settings, and only exposes a normal CLI-style entrypoint and an execute(params) function for agent invocation. Autonomous invocation is enabled by default (disable-model-invocation is false) but that is the platform normal and not an additional privilege requested by this skill.
Assessment
This skill appears coherent with its stated purpose, but you should still exercise normal caution: 1) The service relies on a third-party provider (astrmap / 星图). Verify the provider (https://www.astrmap.com), its privacy policy, and reputation before sharing an API key. 2) The workflow requires installing a desktop client and logging in with an Amazon buyer account; that client will have access to your browsing/account context—do not use a sensitive production/seller account and confirm you trust that software. 3) The skill only needs the CUSTOMER_INSIGHTS_API_KEY; do not supply other secrets. 4) If you want extra assurance, review the included scripts/api_client.py locally (it shows the exact network calls) and run requests through network monitoring or in an isolated environment. 5) Confirm the billing/points model described in the docs so you understand when operations will consume paid credits.Like a lobster shell, security has layers — review code before you run it.
latestvk9711zzz5dfrnaxcbnbh8chb3s84gf6s
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
EnvCUSTOMER_INSIGHTS_API_KEY