Listing Image Optimizer

This skill appears to implement the advertised pipeline but has a few red flags you should consider before installing and running it: - Sensitive credentials: you must create an SP-API credentials file (refresh token, LWA client id/secret, sellerId). Treat this file like a secret — only place it on machines you control and do not expose it. The skill reads the file from AMAZON_SPAPI_PATH or ./amazon-sp-api.json; metadata did not declare this, so double-check before running. - Public HTTP server: push_images.js serves image files on 0.0.0.0 and advertises a public URL for Amazon to crawl. This will expose any files in the directory at that port while the server is running — consider using a trusted public hosting option (S3 with pre-signed URLs or a secure proxy) instead of opening a host/port on a VPS. - Missing file: SKILL.md documents a fix_title.js command but that file is not included. Expect incomplete/rough edges; review the scripts locally before use. - Verify dependencies: npm package amazon-sp-api and pip Pillow will be installed locally. Inspect package versions and consider running in an isolated environment (container or VM). - Best practices: run first on a test account, rotate/revoke SP-API tokens if you suspect exposure, and audit logs and network access. If you are uncomfortable exposing a public port, adapt the code to upload fixed images to S3 and use S3 URLs for SP-API updates instead of a local server.