Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add linkfox-ai/linkfox-skills --skill linkfox-amazon-store-authgit clone --depth 1 https://github.com/linkfox-ai/linkfox-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/linkfox-ai/linkfox-skills/linkfox-amazon-store-auth)<a href="https://agentmods.dev/skills/linkfox-ai/linkfox-skills/linkfox-amazon-store-auth"><img src="https://agentmods.dev/badge/skills/linkfox-ai/linkfox-skills/linkfox-amazon-store-auth/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/linkfox-ai/linkfox-skills/linkfox-amazon-store-auth"><img src="https://agentmods.dev/badge/skills/linkfox-ai/linkfox-skills/linkfox-amazon-store-auth.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Socket warn
- Snyk pass
- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 3 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high System Prompt Leakage · line 140 Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.Fix: Remove any instructions that reveal, print, or output system prompts or internal rules. System instructions should never be exposed to end users.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00147 | $0.03161 |
| Opus 5 | $0.00073 | $0.01580 |
| Sonnet 5 | $0.00029 | $0.00632 |
| Haiku 4.5 | $0.00015 | $0.00316 |
Grade A, and why
linkfox-amazon-store-auth scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 211 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Amazon 店铺授权与管理
本 skill 负责 亚马逊卖家店铺的 OAuth 授权、已授权店铺列表、授权状态查询与令牌刷新，是拉取报告、查询库存、同步订单等所有下游操作的前置依赖。下游业务经 developerProxy 传入 sellerId+region 即可，无需先取 raw token。
📌 Related skill：如果用户需要 拉取亚马逊店铺报告（库存 / 订单 / 销售 / 财务报告等），请切换到
linkfox-amazon-store-report。该 skill 依赖本 skill 提供的授权与令牌能力。
Core Concepts
Selling Partner API 是亚马逊为卖家提供的官方接口。本 skill 负责 OAuth 2.0 授权流程与令牌生命周期管理：
授权流程：生成授权 URL → 用户在 Amazon 完成授权 → Amazon 回调并附带授权码 → 系统用授权码换取令牌 → 令牌安全保存。
店铺名（sellerName）必填：调用 /spApi/authorizeUrl 前必须向用户询问并获取一个清晰、非空的店铺名。它用来在"已授权店铺列表"中标记该账号；不要留空或使用空白字符串。
令牌生命周期：accessToken 通常 1 小时过期；refreshToken 用于在不重新授权的前提下续签新的 accessToken。
Data Fields
Authorization URL Response
| Field | Type | Description |
|---|---|---|
| authorizeUrl | string | 让用户在浏览器打开的 Amazon 授权链接 |
Authorized Store Item
| Field | Type | Description |
|---|---|---|
| sellerId | string | Amazon Seller ID (Merchant ID) |
| sellerName | string | 店铺名（授权时必填） |
| region | string | 市场区域代码 NA / EU / FE |
Store Tokens（授权状态，非 raw token 下发）
POST /spApi/storeTokens 返回状态与元数据（具体字段以网关为准），供确认授权是否有效、何时过期。不要将响应当作下游 developerProxy 的 token 来源。
| Field | Type | Description |
|---|---|---|
| status | string | 授权/令牌状态（如有效、过期、缺失） |
| authRecordId | integer | 授权记录 ID（如有） |
| expiresIn | integer | 距 accessToken 过期的秒数（如有） |
| tokenExpiresAt | string | 绝对过期时间（如有） |
| message | string | 补充说明 |
| errcode / errmsg | integer / string | 网关错误（失败时） |
兼容说明：旧版网关可能仍返回
accessToken/refreshToken；Agent 不应优先读取或传递给下游。下游应使用sellerId+region调developerProxy。
Supported Regions
| Code | Name | Marketplaces |
|---|---|---|
| NA | 北美 | 美国、加拿大、墨西哥 |
| EU | 欧洲 | 英国、德国、法国、意大利、西班牙、荷兰等 |
| FE | 远东 | 日本、澳大利亚、新加坡、印度 |
默认区域为 NA。当用户未指定区域时，使用 NA。
调用方式
- API 端点：
POST /spApi/{authorizeUrl|storeTokens|authorizedStores|refreshToken}（完整参数/响应/错误码见references/api.md） - Python 脚本：
python scripts/<脚本名>.py '<JSON 参数>' [--inline]（可用脚本见上文） - 成本约束：本工具会消耗积分；失败/空结果不得自动连续试探；需要继续检索时先向用户说明会产生额外消耗。
What ships with it
12 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/api.md 5.6 KB
- references/authorization-flow.md 13 KB
- references/onboarding.md 2.0 KB
- references/quick-start.md 6.9 KB
- scripts/_lf_output.py 6.3 KB runs code
- scripts/_token_status_output.py 1.0 KB runs code
- scripts/authorize_url.py 3.8 KB runs code
- scripts/authorized_stores.py 2.3 KB runs code
- scripts/onboarding.py 24 KB runs code
- scripts/README.md 2.3 KB
- scripts/refresh_token.py 2.8 KB runs code
- scripts/store_tokens.py 2.7 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 211 lines · 147 tokens per session scan A 4868ed332d34
linkfox-amazon-store-auth is a skill published in the GitHub repository linkfox-ai/linkfox-skills (101 stars, last pushed 20d ago), licensed MIT. It adds 147 tokens to every session and 3,161 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
amazon-reviews-api-skill
This skill helps users automatically extract Amazon product reviews via the Amazon Reviews API. Agent should proactively apply this skill when users express needs like getting reviews for Amazon product with ASIN B07TS6R1SF, analyzing customer feedback for a specific Amazon item, getting ratings and comments for a…
amazon-competitor-analyzer
Scrapes Amazon product data from ASINs using browseract.com automation API and performs surgical competitive analysis. Compares specifications, pricing, review quality, and visual strategies to identify competitor moats and vulnerabilities.
asc-subscription-localization
Bulk-localize subscription, subscription-group, and in-app purchase display names across App Store locales using asc, including API 4.4.1 version-scoped v2 resources. Use when filling or updating subscription/IAP names and descriptions without App Store Connect UI work.
food-order
Reorder previous Foodora orders, preview cart contents, and track delivery ETA/status with ordercli. Use when the user wants to reorder food, check delivery status, or browse recent Foodora order history. Never confirm an order without explicit user approval.
product-description-generator
E-commerce product description generator for any platform. Generates optimized titles, bullet points, descriptions, and backend keywords using competitor research + keyword scoring + FABE copywriting. Two modes: (A) Create — generate listing from product specs with optional competitor analysis, (B) Optimize — improve…
amazon-price-tracker
Amazon price monitoring and competitive pricing intelligence. Real-time price tracking, Buy Box analysis, promotion detection, and dynamic pricing strategy optimization. Use when the user asks about price monitoring, competitor pricing, Buy Box tracking, or pricing strategy.