Amazon Ads API

ReviewAudited by ClawScan on May 10, 2026.

Overview

This appears to be a straightforward Amazon Ads reporting helper, but it requires sensitive Amazon Ads OAuth credentials and its README overstates some optimization/bidding capabilities.

Install only if you are comfortable giving the agent access to your Amazon Ads account data. Keep the credential file private, use least-privilege credentials where possible, and verify the code before relying on any advertised bidding or optimization features.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI03: Identity and Privilege Abuse

What this means

If installed and configured, the agent can use your Amazon Ads credentials to list advertiser profiles and campaign/budget information for the configured account.

Why it was flagged

The skill uses Amazon Ads OAuth credentials to obtain access tokens. This is expected for the stated Amazon Ads purpose, but these credentials can provide access to advertiser account data.

Skill content

refresh_token: creds.refreshToken, client_id: creds.lwaClientId, client_secret: creds.lwaClientSecret

Recommendation

Use a dedicated Amazon Ads app/token with the minimum needed permissions, store amazon-ads-api.json securely, avoid sharing the file, and rotate or revoke the refresh token if you stop using the skill.

Low

#ASI09: Human-Agent Trust Exploitation

What this means

You may expect broader automation than the provided code actually performs.

Why it was flagged

The README advertises bid, keyword, and daily optimization capabilities, but the included script only lists profiles/campaigns and prints a budget summary.

Skill content

manage campaigns, keywords, bids, and run daily optimization

Recommendation

Treat the current skill as a read/reporting helper unless you review additional code that implements bidding, keyword, or optimization changes.