Security audit
Security checks for vulnerabilities and agentic risk
This A+ planning skill needs review because it exposes broader account controls and can spend credits through a documented quote-only workflow.
Prefer a corrected A+-only release that enforces approval before spending and fixes quote-only execution. If using this version, set billing to ask every time, restrict requests to the A+ workflow, and explicitly decline recurring monitoring unless wanted.
scripts/ari.pyQuote-only deepdive can execute paid analysis
Unexpected consumption of the user's analysis credits. For a missing main-product subscription, the CLI can additionally claim the analysis was downgraded and not charged despite reaching the paid execution path.
Creating product and competitor watches introduces persistent, billable state beyond the declared A+ purpose. The document requires explicit recurring-price consent and competitor ownership checks, so the supported concern is scope confusion rather than a demonstrated billing or ownership bypass.
The A+-only description and final fixed-workflow section conflict with extensive instructions for account-wide operations, recurring collection, and automatically charged VOC generation. This creates an instruction-level scope and spending boundary failure, although the supplied material does not independently verify the claimed CLI implementation.
Persistent paid watches exceed the declared planning-only boundary and remain available in the instructions despite the final A+-only restriction. Explicit watch pricing and consent requirements reduce the risk of unauthorized charges, but do not resolve the contradictory capability boundary.
The competitor-binding instruction says added competitors enter weekly automatic collection without an adjacent requirement to authorize that recurring side effect. Consent to a comparison report does not necessarily authorize ongoing competitor collection, particularly in a planning-only skill.
This duplicates the persistent-watch scope issue: the document exposes recurring paid account changes through a skill advertised as content planning only. Required pricing confirmation mitigates financial abuse, but conflicting workflow instructions still undermine isolation of the specialized skill.
The skill includes recurring collection management and a weekly default for new products, although its stated role is one-off A+ planning. Instructions to use manual scheduling without recurring authorization are protective, but leaving both workflows active creates avoidable risk of persistent billing outside the selected scope.
The supplied commands concern watch-service inspection and pricing rather than gathering product/review evidence or planning A+ content. Although they use the declared ARI tooling, their capabilities are not described or shown to support the stated purpose. The snippet does not show watch creation, advertising, image generation, or publishing.
The visible commands concern watch monitoring and historical reporting, a capability not disclosed by the A+ content-planning description. The chunk does not show how these watch outputs provide product-detail or review evidence for A+ planning, so they are not established as supporting implementation details. This assessment is limited to the supplied commands; the underlying ARI implementation is not shown.
The visible commands concern watch-service configuration and pricing rather than A+ content planning. These capabilities are not declared, and the supplied chunk does not establish that they support the stated planning workflow. Because the underlying ari.py implementation is not shown, this assessment is limited to the command invocations and their accompanying description; it does not infer additional API access or side effects.
The supplied command requests a category ranking rather than product-specific evidence analysis or A+ content planning. Although review analysis can support the declared purpose, category-wide leaderboard generation is a distinct, undeclared operation. The snippet does not establish the CLI's underlying network access, credential handling, or any publishing behavior.
The supplied command targets alerts, rather than an operation visibly connected to product evidence or A+ content planning. Alert functionality is not declared, and the supplied chunk establishes no supporting relationship to the stated purpose. The mismatch assessment is limited to this command; without scripts/ari.py, its precise actions, resource access, and side effects cannot be verified.
Collection defaults to weekly monitoring unless manual scheduling is explicitly requested, potentially turning a one-time A+ planning task into recurring paid collection. Quoting monitoring costs does not itself establish consent, and the instruction to preserve existing schedules does not protect newly collected products from this default.
run_analysis promotes an absent --confirm into confirmation based on the server's autoConfirm value, contradicting the explicit-confirmation contract. cmd_voc similarly allows collection and analysis without the flag, and deepdive can consequently charge even when its caller intends quote-only behavior; no independent local spending cap or prior consent verification is shown.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 重新发布：各市场首批上架的 1.5.0 包早于免确认修复，新注册的免费版用户仍会被要求先确认报价。
1.5.1 与当前官网下发的修复版一致，市场侧以新版本号覆盖旧包。
- 免确认只认服务端报价返回的 `autoConfirm`；采集报价扣除首次采集免费页；
非美国站首次采集可用赠送积点时不再提示「赠送积点不可用」（行为与修复后的 1.5.0 相同）。
- 命令、字段与计费规则不变，不提高最低支持版本。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 行为变更：新用户（注册并验证邮箱后）第一次要 VOC，只给 ASIN 即可（站点默认美国站），
`voc` 直接执行——自动补采集（默认 3 页）、生成报告、按服务端定价扣费并归档，
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
为 true 时赠送积点计入 `nonUsCollectCredits`、`siteNote` 为空；UK/DE/JP 卖家的第一份 VOC 同样一步直出。
- 余额不足仍在执行前拦截（402）并引导充值；定价以服务端配置为准，代码常量仅为兜底。
- 一致性：`analyze` 各类型（insight / keywords / trend / variant / compare）走同一口径，
`autoConfirm=true` 即直接生成并返回 `charges`。
- 文档：移除所有写死的单价与合计示例。采集/分析单价与页数由后台 `pricing` 配置决定，
一律以本次报价返回的 `credits` / `totalCredits` 为准，不得凭文档或记忆报数。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 能力层收窄：44 个专属包不再只是「声明窄」，包体 `scripts/ari.py` 同时按各自契约裁剪。
构建期用 AST 删除文档未承诺的命令、它们的解析器注册块，以及只被它们引用的辅助函数与
常量；专属包因此不再包含 `export`（任意路径写文件）、`autoconfirm`（撤销逐次确认）、
`workbench`（改写差评处理状态）、`alerts`（标记预警已读）、`competitors`、`schedule`、
`voc` / `analyze` / `charts` / `deepdive` 等母版命令。
- 新增运行期兜底闸：专属包在包内写入 `allowedCommands` 白名单，`ari.py`
Without declared permissions the skill's intent is opaque and cannot be validated.
The skill treats server-defined first-use allowances and remaining automatic-confirmation counts as permission to spend, including first-use processing without an amount limit. Those service defaults are not equivalent to user-authorized spending, unlike a threshold explicitly configured by the user.
`voc <ASIN>`（没说站点就用默认的美国站，不要为此追问）。
命中服务端免确认规则（新用户首次体验不看金额 / 账户剩余免确认次数 / 用户自设阈值）且余额充足时，
**直接完成采集 + 生成 + 扣点并归档**，不再停在报价环节。绝不能描述成“先帮你问个价 / 只报价不扣点”。
免确认与否以返回里的 `autoConfirm` 为准，不要自己从提示文案里猜。
- 直接生成成功后，返回结果带 `charges`（采集扣点、分析扣点、合计、扣前/扣后余额）与 `autoConfirmNote`。
**先讲报告，再用一句话转述实际扣点**，不要在拿到结果后再补问「要不要生成」，也不要回头补一次报价。
- 只有在返回 `confirmationRequired: true` 时（余额不足、或用户自行设置了“每次先问”）
The autoConfirm response is used as the sole spending gate even though the preceding rules include provider-defined first-run defaults. A server response can indicate that execution is permitted without proving that the user knowingly approved the charge.
命中服务端免确认规则（新用户首次体验不看金额 / 账户剩余免确认次数 / 用户自设阈值）且余额充足时，
**直接完成采集 + 生成 + 扣点并归档**，不再停在报价环节。绝不能描述成“先帮你问个价 / 只报价不扣点”。
免确认与否以返回里的 `autoConfirm` 为准，不要自己从提示文案里猜。
- 直接生成成功后，返回结果带 `charges`（采集扣点、分析扣点、合计、扣前/扣后余额）与 `autoConfirmNote`。
**先讲报告，再用一句话转述实际扣点**，不要在拿到结果后再补问「要不要生成」，也不要回头补一次报价。
- 只有在返回 `confirmationRequired: true` 时（余额不足、或用户自行设置了“每次先问”）
才报出 `totalCredits` 与余额并等待同意，同意后追加 `--confirm`。
This section introduces account-wide monitoring and weekly collection defaults into a narrowly scoped planning skill. Its explicit consent and manual-fallback rules mitigate billing risk, but the conflicting capability scope still permits persistent account operations unrelated to the declared entry point.
The workflow explicitly skips quoting and calls a VOC endpoint that may collect data, generate a report, and charge before any price is presented. Post-execution disclosure of charges cannot substitute for payment authorization, and this path conflicts with the final A+-specific quote-first requirement.
1. 运行 `check`，确认账户、邮箱验证状态和可用积点。
2. 用户要 VOC / 评论分析报告时，默认运行 `voc <ASIN> --site <站点>`，**不要再先跑一次报价**。
**返回里有 `autoConfirmed: true`（或直接带 `reportId` / 正文）就说明报告已经生成并扣点了**
（1.5.0：新用户首次体验直接出结果，用户先拿到报告再谈钱）。
此时把报告讲给用户，并转述 `charges` — 本次采集扣了多少、分析扣了多少、合计多少、扣后还剩多少。
**不要在拿到结果后再补问「要不要生成」，也不要再回头补一次报价。**
These instructions direct the agent to run paid keyword analysis for advertising terms, negative keywords, competitor-brand keywords, and backend Search Terms, and to proactively promote advertising use after a VOC report. Although this does not establish actual ad deployment, it does introduce advertising and general Listing optimization deliverables outside the manifest's A+-planning-only scope.