Amazon Ads Reporter

ReviewAudited by ClawScan on May 10, 2026.

Overview

The skill looks purpose-aligned for Amazon Ads reporting, but it needs your Amazon Ads credential file and the docs do not fully match the included scripts.

Only use this if you are comfortable granting the scripts access to your Amazon Ads OAuth credential file. Verify the credential file is scoped to the right profile, treat the included code as EU-endpoint-only, and do not rely on the missing campaign-report scripts unless you obtain and review them separately.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI03: Identity and Privilege Abuse

What this means

Anyone running the skill gives it access to Amazon Ads reporting data for the configured profile.

Why it was flagged

The skill reads local Amazon Ads OAuth credentials and uses them to request an access token. This is necessary for the stated reporting function, but it grants access to the user's Amazon Ads profile.

Skill content

const CREDS_PATH = process.env.AMAZON_ADS_PATH || `${process.env.HOME}/amazon-ads-api.json`; ... refresh_token: creds.refreshToken ... client_secret: creds.lwaClientSecret

Recommendation

Use a credential file only for the intended Amazon Ads account/profile, keep it protected, and review the scripts before running them with production credentials.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

The documented campaign-level commands may fail, and any later-added scripts would need separate review before trusting them.

Why it was flagged

SKILL.md documents campaign-report scripts that are not present in the supplied file manifest, which only includes SKILL.md, scripts/get-bids.js, and scripts/keyword-report.js.

Skill content

node scripts/request-report.js --days 7 ... node scripts/poll-report.js ... node scripts/get-report.js --days 7

Recommendation

Verify that all referenced scripts are present and reviewed before running the campaign-level workflow.

Low

#ASI09: Human-Agent Trust Exploitation

What this means

Users outside the EU may unknowingly call the wrong regional Amazon Ads endpoint or get failed/unexpected results.

Why it was flagged

SKILL.md describes EU, NA, and FE regions, but the included scripts hardcode the EU Amazon Advertising API endpoint, so the advertised region configurability is not implemented here.

Skill content

const API_BASE = 'https://advertising-api-eu.amazon.com';

Recommendation

Treat this package as EU-only unless the code is updated and reviewed to honor the configured region.