
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
ask-smapi-sdk
Advanced tools
ask-smapi-sdk is a library for Alexa Skills Kit's Skill Management APIs (SMAPI).
Learn more about SMAPI by reviewing the SMAPI documentation.
Client ID and Client Secret keys.ask util generate-lwa-tokens --client-id <Client ID> --client-confirmation <Client Secrect>. Replace the <Client ID> and <Client Secrect> with the Client ID and Client Secret keys from the previous step.
This will return the following JSON with a Refresh Token:{
"access_token": "ACCESS_TOKEN",
"refresh_token": "REFRESH_TOKEN",
"token_type": "bearer",
"expires_in": 3600,
"expires_at": "2019-11-19T20:25:06.584Z"
}
$ npm install ask-smapi-sdk
Using the Client ID, Client Secret and Refresh Token retrieved in the previous step to configure a new SMAPI client:
const Alexa = require('ask-smapi-sdk');
// specify the refreshTokenConfig with clientId, clientSecret and refreshToken generated in the previous step
const refreshTokenConfig = {
clientId,
clientSecret,
refreshToken
}
const smapiClient = new Alexa.StandardSmapiClientBuilder()
.withRefreshTokenConfig(refreshTokenConfig)
.client();
import * as Alexa from 'ask-smapi-sdk';
// specify the refreshTokenConfig with clientId, clientSecret and refreshToken generated in the previous step
const refreshTokenConfig : Alexa.RefreshTokenConfig = {
clientId,
clientSecret,
refreshToken
}
const smapiClient = new Alexa.StandardSmapiClientBuilder()
.withRefreshTokenConfig(refreshTokenConfig)
.client();
# To only retrieve response body
smapiClient.listSkillsForVendorV1(vendorId)
.then((response) => {
console.log(JSON.stringify(response));
})
.catch((err) => {
console.log(err.message);
console.log(JSON.stringify(err.response));
});
# To include response header and status code
smapiClient.callListSkillsForVendorV1(vendorId)
.then((response) => {
console.log(response.header);
})
.catch((err) => {
console.log(err.message);
console.log(JSON.stringify(err.response));
});
smapiClient.getSkillManifestV1(skillId, stage)
.then((response) => {
console.log(JSON.stringify(response));
})
.catch((err) => {
console.log(err.message);
console.log(JSON.stringify(err.response));
});
For the complete list of functions, please see the SMAPI SDK reference documentation.
For bug reports, feature requests and questions, we would like to hear about it. Search the existing issues and try to make sure your problem doesn’t already exist before opening a new issue. It’s helpful if you include the version of the SDK, Node.js or browser environment and OS you’re using. Please include a stack trace and reduced repro case when appropriate, too.
This SDK is distributed under the Apache License, Version 2.0, see LICENSE for more information.
FAQs
Core package for SMAPI Skills Kit SDK
The npm package ask-smapi-sdk receives a total of 947 weekly downloads. As such, ask-smapi-sdk popularity was classified as not popular.
We found that ask-smapi-sdk demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.