Skill Amazon Spapi

Amazon SP-API skill for OpenClaw agents. Fetch orders, check FBA inventory, manage listings and pricing. Works with any marketplace and seller account.

Security Scan

The skill's code, instructions, and requirements are coherent for an Amazon SP-API integration; nothing in the files indicates hidden exfiltration or unrelated privileges.

Purpose & Capability

Name/description (SP-API: orders, inventory, listings) match the included scripts and required node binary. The scripts use LWA credentials, sellerId, and marketplace IDs which are expected for this purpose.

Instruction Scope

SKILL.md describes installing the amazon-sp-api npm package, creating a local credentials JSON, and running the provided scripts. The scripts only call SP-API endpoints, read the local credential file (AMAZON_SPAPI_PATH), and optionally write JSON output files — all within the stated feature set.

Install Mechanism

There is no platform install spec; SKILL.md instructs the user to run `npm install amazon-sp-api`. Installing an npm package is standard here, but any npm package carries the usual supply-chain risk; user should prefer installing from a vetted source and review the package before running.

Credentials

The registry metadata lists no required env vars, but the code and docs rely on AMAZON_SPAPI_PATH (default ./amazon-sp-api.json) and a local credential file containing LWA client id/secret and refresh token. Storing credentials in a local file is coherent but the declared metadata is inconsistent with the runtime instructions (missing env var declaration).

Persistence & Privilege

Skill is not marked always:true, does not request system-wide config changes, and only reads a local creds file and writes optional output files. It does not modify other skills or system settings.

Assessment

This skill appears to do exactly what it claims: interact with Amazon SP-API using LWA credentials stored in a local JSON file. Before installing/running: 1) Review the amazon-sp-api npm package source/version you will install (supply-chain risk). 2) Keep the credential file secure (chmod 600 as recommended) and do not commit it to source control. 3) Note the small metadata inconsistency: the skill uses AMAZON_SPAPI_PATH but the registry metadata does not list any required env vars — ensure you set that env var or place the file at ./amazon-sp-api.json. 4) Only run these scripts from a trusted environment because they have network access to your seller data and can update listings/pricing.

Amazon SP-API Skill

Fetch orders, check FBA inventory, and manage listings — plug-and-play for any OpenClaw agent.

---

Setup

1. Install dependency

npm install amazon-sp-api

2. Create credentials file

{
  "lwaClientId": "amzn1.application-oa2-client.YOUR_CLIENT_ID",
  "lwaClientSecret": "YOUR_CLIENT_SECRET",
  "refreshToken": "Atzr|YOUR_REFRESH_TOKEN",
  "region": "eu",
  "marketplace": "YOUR_MARKETPLACE_ID",
  "sellerId": "YOUR_SELLER_ID"
}

Save as amazon-sp-api.json. Set AMAZON_SPAPI_PATH env var to point to it (default: ./amazon-sp-api.json).

Regions: na | eu | fe Marketplace IDs: Full list

---

Scripts

auth.js — Test Connection

node scripts/auth.js

orders.js — Orders

node scripts/orders.js --list                          # last 7 days
node scripts/orders.js --list --days 30
node scripts/orders.js --list --status Unshipped
node scripts/orders.js --list --out orders.json
node scripts/orders.js --get ORDER-ID

inventory.js — FBA Inventory

node scripts/inventory.js
node scripts/inventory.js --sku "MY-SKU"
node scripts/inventory.js --out inventory.json

listings.js — Listings & Pricing

node scripts/listings.js --get "MY-SKU"
node scripts/listings.js --update "MY-SKU" --price 99.00
node scripts/listings.js --update "MY-SKU" --price 99.00 --currency USD

---

Notes

• Tokens auto-refresh via LWA — no manual management
• Keep credential files at chmod 600
• Respect SP-API rate limits per endpoint

Related

• skill-amazon-ads — Campaign & bid management