Security audit
Security checks for vulnerabilities and agentic risk
This single-product audit skill includes broader account controls, automatic spending, and recurring monitoring with conflicting approval rules.
Review before installing. Require approval before every charge, use manual collection for one-time work, and check existing recurring schedules separately. The publisher should enforce the advertised audit-only scope and resolve conflicting spending instructions. The inspected files support a consent-and-scope concern, not evidence of malware or credential theft.
scripts/ari.pyRecurring collection can be enabled without an executable confirmation gate
An Agent or integration can enable recurring collection before obtaining cost approval, allowing subsequent deductions from the user's ARI balance until the schedule is disabled or service-side limits intervene.
The declared scope explicitly limits the skill to an overall diagnosis of one ASIN. The supplied command instead selects a category and requests a leaderboard, without specifying an ASIN. This is a materially different, cross-product analytical capability rather than a supporting implementation detail. The snippet does not establish any additional side effects from --confirm.
The command specifies --type compare and --competitor B0BBBBBBBB alongside the target ASIN. This requests a competitive comparison rather than the declared single-ASIN overall diagnosis. The supplied chunk does not establish additional behavior such as advertising, inventory management, or profit calculation.
The command specifies --type compare and supplies --competitor B0BBBBBBBB alongside --asin B0AAAAAAAA. This requests comparative analysis rather than the declared single-ASIN overall diagnosis. The supplied chunk does not establish any additional mismatches involving advertising, inventory, or profit calculations.
The document mixes a fixed, explicitly confirmed audit workflow with broader instructions to execute credit-consuming VOC work automatically, creating conflicting authorization paths. The final audit-only restriction mitigates this, and contradicts the finding's assertion that workflow selection is unrestricted, but the competing paid-execution instructions still create a credible unintended-spending risk.
The declared purpose explicitly limits the skill to an overall diagnosis of a single ASIN. The supplied commands instead provide an ongoing monitoring workflow, including weekly schedules, competitor comparisons, and price-accepted watch creation or resumption. These are material user-facing capabilities, not merely implementation details supporting a one-time diagnosis. The underlying Python implementation is not supplied, so the assessment is limited to the capabilities exposed by these commands.
These commands describe a recurring monitoring workflow rather than merely gathering evidence for a single-ASIN audit. Historical data could support diagnosis, but managing scheduled watches, including competitor tracking and per-refresh price acceptance, introduces substantive undeclared capabilities. The chunk contains command examples, so it does not establish that any watch was actually created or any charge incurred.
声明描述的是单 ASIN 的诊断分析，而代码片段展示的是具有持久状态的监控任务管理，还包含竞品对比和刷新价格接受操作。这些是实质性的额外能力，并非完成一次诊断所需的普通实现细节。片段未展示底层实现，因此不能确认实际扣费或数据访问细节，但可明确识别出声明与所提供命令功能不一致。
The declared purpose covers a single-ASIN diagnostic assessment, not managing ongoing monitoring or collection schedules. Although collecting product and review data can support an audit, enabling recurring collection is an additional persistent operational capability, not merely an implementation detail. The supplied chunk invokes these scheduling operations; the underlying implementation and billing behavior are not shown.
Obtaining a product ID could support the declared audit. However, explicitly binding competitors for automatic weekly collection and comparing trends over 12 weeks introduces ongoing competitive monitoring not disclosed in the description, which limits the skill to single-ASIN diagnosis. The supplied chunk shows command invocations rather than their implementation, so underlying data access and collection mechanisms cannot be verified.
The supplied commands concern recurring monitoring and its pricing rather than a single-ASIN diagnostic report. These capabilities are not disclosed in the declared purpose. The underlying script is not supplied, so this assessment is limited to the visible command invocations and their accompanying comment; it does not assume additional data access or side effects.
The supplied commands concern monitoring-service pricing and watch listings rather than product-detail or review-based ASIN diagnosis. These are distinct capabilities not disclosed in the description, and the chunk does not establish that they support a single-ASIN audit. The shown commands do not demonstrate creating watches, changing settings, or placing charges.
The supplied commands expose a watch-oriented reporting workflow rather than the declared product-detail and review-based ASIN diagnosis. They operate on a watch ID and retrieve monitoring history without showing how that history supports a single-ASIN audit. The chunk does not demonstrate watch creation, advertising, inventory management, or profit calculations; those capabilities are not inferred.
The supplied command targets alerts, while the description limits the skill to a single-ASIN audit based on listing and review evidence. No ASIN or diagnostic operation appears in the command. This indicates a scope mismatch, although the missing implementation of scripts/ari.py prevents confirming whether alerts are retrieved, configured, or otherwise processed.
run_analysis replaces an absent --confirm with approval derived from the server's autoConfirm field, allowing a nominal quote-only invocation to spend credits. cmd_voc similarly permits collection and analysis without explicit confirmation, contradicting the CLI's stated safety contract; a remote account policy does not establish consent to this particular operation.
This documents delegating authorization for paid operations to a server-provided autoConfirm flag. The surrounding release notes describe default confirmation-free charging without establishing prior user consent to a spending limit, so a routine ASIN request could consume credits unexpectedly. This is evidence of a risky documented policy, not proof that the narrowed ASIN-audit package implements it.
- 重新发布：各市场首批上架的 1.5.0 包早于免确认修复，新注册的免费版用户仍会被要求先确认报价。
1.5.1 与当前官网下发的修复版一致，市场侧以新版本号覆盖旧包。
- 免确认只认服务端报价返回的 `autoConfirm`；采集报价扣除首次采集免费页；
非美国站首次采集可用赠送积点时不再提示「赠送积点不可用」（行为与修复后的 1.5.0 相同）。
- 命令、字段与计费规则不变，不提高最低支持版本。
The documented workflow automatically collects data, generates a report, and deducts credits from an ASIN-only request; the initial automatic operations explicitly have no monetary ceiling. Gift credits, balance checks, and reporting charges afterward limit some consequences but do not establish advance authorization for the actual cost. This creates a potential unexpected-credit-consumption issue if this workflow is reachable.
- 行为变更：新用户（注册并验证邮箱后）第一次要 VOC，只给 ASIN 即可（站点默认美国站），
`voc` 直接执行——自动补采集（默认 3 页）、生成报告、按服务端定价扣费并归档，
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
This occurrence belongs to the same automatic-charging policy as the finding at line 32, rather than a separate vulnerability. Parsing a structured boolean instead of explanatory prose is appropriate, but allowing that boolean to authorize uncapped default spending without demonstrated user opt-in is the underlying consent risk. Explicit user thresholds and ask-every-time settings reduce, but do not eliminate, that default-policy problem.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
This is a duplicate match within the same passage, not an additional independent exposure. The concern is the documented use of server policy to skip confirmation for initially uncapped paid operations, not the autoConfirm identifier itself. Actual exposure depends on whether the specialized ASIN-audit package includes or reaches this historical shared workflow.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
This extends the same confirmation-free charging behavior to several analysis types, increasing the number of operations that could unexpectedly consume credits. Returning charges after generation provides transparency but cannot replace advance spending authorization. The changelog also says specialized packages remove analyze, so applicability to this exact package remains unverified.
为 true 时赠送积点计入 `nonUsCollectCredits`、`siteNote` 为空；UK/DE/JP 卖家的第一份 VOC 同样一步直出。
- 余额不足仍在执行前拦截（402）并引导充值；定价以服务端配置为准，代码常量仅为兜底。
- 一致性：`analyze` 各类型（insight / keywords / trend / variant / compare）走同一口径，
`autoConfirm=true` 即直接生成并返回 `charges`。
- 文档：移除所有写死的单价与合计示例。采集/分析单价与页数由后台 `pricing` 配置决定，
一律以本次报价返回的 `credits` / `totalCredits` 为准，不得凭文档或记忆报数。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 能力层收窄：44 个专属包不再只是「声明窄」，包体 `scripts/ari.py` 同时按各自契约裁剪。
构建期用 AST 删除文档未承诺的命令、它们的解析器注册块，以及只被它们引用的辅助函数与
常量；专属包因此不再包含 `export`（任意路径写文件）、`autoconfirm`（撤销逐次确认）、
`workbench`（改写差评处理状态）、`alerts`（标记预警已读）、`competitors`、`schedule`、
`voc` / `analyze` / `charts` / `deepdive` 等母版命令。
- 新增运行期兜底闸：专属包在包内写入 `allowedCommands` 白名单，`ari.py`
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
def cmd_autoconfirm(args):
"""免确认阈值：不带参数=查看；`autoconfirm 50`=50 积点以内不问；`autoconfirm off`=每次都问；`autoconfirm default`=恢复默认。"""
value = (args.value or "").strip().lower()
if value:
if value in ("off", "ask", "0"):
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
def cmd_autoconfirm(args):
"""免确认阈值：不带参数=查看；`autoconfirm 50`=50 积点以内不问；`autoconfirm off`=每次都问；`autoconfirm default`=恢复默认。"""
value = (args.value or "").strip().lower()
if value:
if value in ("off", "ask", "0"):
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
def cmd_autoconfirm(args):
"""免确认阈值：不带参数=查看；`autoconfirm 50`=50 积点以内不问；`autoconfirm off`=每次都问；`autoconfirm default`=恢复默认。"""
value = (args.value or "").strip().lower()
if value:
if value in ("off", "ask", "0"):
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
limit = int(value)
except ValueError:
emit(error_obj("ARI_BAD_ARGUMENT", 0, "参数不对",
"用法：autoconfirm 50（50 积点以内不问）/ autoconfirm off（每次都问）/ autoconfirm default（恢复默认）"),
args.compact)
return
out = request_json("PUT", "/api/v1/user/autoconfirm", {"limit": limit})
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
limit = int(value)
except ValueError:
emit(error_obj("ARI_BAD_ARGUMENT", 0, "参数不对",
"用法：autoconfirm 50（50 积点以内不问）/ autoconfirm off（每次都问）/ autoconfirm default（恢复默认）"),
args.compact)
return
out = request_json("PUT", "/api/v1/user/autoconfirm", {"limit": limit})