Amazon 热销商品页拆解

• Outcome: Review
• Latest audit: Sep 8, 2026 · 5:31 AM UTC
• Version: 1.4.8

Overview

This appears to be a legitimate Amazon/ARI analysis skill, but it exposes broader account, monitoring, and billable actions than its teardown-focused listing suggests.

Install only if you are comfortable giving this skill an ARI API key and letting it access ARI account data, saved reports, review data, monitoring state, and credit-consuming analysis workflows. Use explicit wording such as 'only quote, do not execute' when you do not want charges, and review or disable autoconfirm and monitoring settings before relying on it for routine use.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/ari.py:1109
• Finding: Server-Controlled Auto-Confirmation Can Trigger Paid Operations Without Transaction-Specific Consent<![CDATA[ ## Vulnerability Details **File Location**: `scripts/ari.py:1109-1114` **Additional Location**: `scripts/ari.py:1318-1323`, `SKILL.md:79-81`, `SKILL.md:132-133` **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: High ### Vulnerable Code ```python auto_confirmed = False if not confirm and q_data.get("autoConfirm") and q_data.get("sufficient"): confirm = True auto_confirmed = True if not confirm: return {"success": True, "data": {"confirmationRequired": True, "quote": q_data, ``` The same behavior is implemented in the combined collection and VOC workflow: ```python auto_max = int(analysis_quote.get("autoConfirmMaxCredits") or 0) auto_confirmed = (not args.confirm and bool(analysis_quote.get("autoConfirm")) and sufficient and total_credits <= auto_max) if not args.confirm and not auto_confirmed: ``` ### Technical Analysis The CLI allows a value supplied by the remote service, `autoConfirm`, to substitute for explicit confirmation of a chargeable operation. When the quote response reports both `autoConfirm: true` and sufficient credits, the local code changes `confirm` to `True` even though the user did not provide `--confirm`. This violates the security principle that authorization for a financial or quota-consuming action should be: 1. Explicitly supplied by the user. 2. Bound to the specific transaction and quoted amount. 3. Enforced locally at the final execution boundary. 4. Independent of untrusted or remotely mutable response data. The Skill instructions reinforce this behavior by directing the Agent to execute eligible paid operations without asking for transaction-specific confirmation. Although this may be an intended account feature, the remote service controls whether it is activated for a particular quote. Consequently, a compromised service, configuration error, stale account policy, or unexpected quote response can authorize spending without a fresh user decision. ### Att ...[truncated 1564 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require `--confirm` for every chargeable operation at the final execution boundary. 2. Do not convert a remotely supplied `autoConfirm` value into local authorization. 3. If automatic spending is retained, require the user to enable it explicitly through a local configuration action. 4. Store the locally approved spending policy securely and bind it to: - A maximum amount per operation. - A maximum cumulative amount per session or day. - Specific operation types. - The intended service origin. 5. Before execution, compare the final operation amount against the locally approved limit rather than relying solely on quote fields. 6. Return the exact quote and require confirmation whenever the amount, operation type, ASIN, site, or competitor differs from the user's prior authorization. 7. Add an idempotency key to every paid request and reject accidental duplicate submissions. 8. Record a local audit entry containing the operation, quoted amount, confirmation source, timestamp, and request identifier without storing the full API key. 9. Change the Skill instructions so that an absent `--confirm` always means quote-only unless the user has explicitly enabled a clearly disclosed local spending policy. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:33
• Finding: Mandatory Session Startup Requests Exceed the Specialized Teardown Workflow's Minimum Data Access<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:33-34` **Additional Location**: `SKILL.md:102-104`, `scripts/ari.py:588-609` **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: Medium ### Relevant Code The account-check command retrieves user account details, credit balances, and the account's automatic-confirmation policy: ```python def cmd_check(args): release = fetch_release() me = request_json("GET", "/api/v1/user/me") if not ok(me): emit(me, args.compact) return balance = request_json("GET", "/api/v1/credits/balance") if not ok(balance): emit(balance, args.compact) return auto = request_json("GET", "/api/v1/user/autoconfirm") emit({"success": True, "data": { "skillVersion": VERSION, "release": release, "user": data_of(me), "balance": data_of(balance), "autoConfirm": data_of(auto) if ok(auto) else None, }, "links": links()}, args.compact) ``` The Skill instructions require this check at the start of every session and additionally direct the Agent to retrieve review alerts. These requests are required even when the user's request could be answered from an existing report or other previously available data. ### Technical Analysis The specialized Skill declares a product-page teardown purpose, but its startup workflow expands access to unrelated account state. An invocation can cause authenticated retrieval of: - User account information. - Credit balances. - Automatic spending-confirmation settings. - Unread review alerts. These fields are not always necessary to analyze a previously supplied product page or summarize an existing report. Requiring them at every session violates data minimization and least-privilege principles. Every unnecessary authenticated request also increases exposure of the bearer credential to the network and gives the Agent access to account metadata that may be unrel ...[truncated 1839 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the requirement to run `check` at the start of every session. 2. Run account and balance checks only immediately before an operation that requires authentication, credit validation, or billing. 3. Fetch alerts only when: - The user explicitly asks for alerts. - Alert review is the active workflow. - The user has explicitly opted into proactive alert checks. 4. Split the existing account check into narrowly scoped endpoints or commands, such as: - Credential validity only. - Balance only. - Spending-policy status only. 5. Avoid returning full user account objects when a Boolean authentication result is sufficient. 6. Keep account metadata out of the Agent context unless it is directly relevant to the current request. 7. Document every startup network request and provide a local or offline mode for summarizing existing reports. 8. Apply purpose limitation so the specialized teardown entry point invokes only product-detail, competitor-detail, review, and report operations required for that task. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (39)

Tainted flow: 'req' from os.environ.get (line 1459, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers = {"Authorization": "Bearer " + require_key(), "User-Agent": user_agent()}
    try:
        req = urllib.request.Request(url, headers=headers, method="GET")
        with urllib.request.urlopen(req, timeout=TIMEOUT_SEC) as resp:
            note_release(resp.headers)
            ctype = resp.headers.get("Content-Type", "")
            body = resp.read()

• Confidence: 62% confidence
• Finding: Although custom base URLs are intentionally gated, enabling ARI_ALLOW_CUSTOM_BASE=1 causes authenticated export requests to send the Bearer API key to an arbitrary host from environment variables. In an agent or shell-injection context, any workflow that can set both variables can redirect credentials and downloaded data off-platform.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill declares no permissions while instructing use of shell execution, network access, environment variables, and local key storage/configuration. This creates a trust-boundary mismatch: reviewers or policy gates may treat the skill as low-privilege even though it can authenticate to a remote service, persist secrets, and invoke paid operations. In security terms, hidden capabilities increase the chance of unintended command execution, credential exposure, and billing-impacting actions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The public description says the skill is only for static teardown of user-provided or authorized competitor pages, but the content authorizes a much broader operational surface: authentication, paid collection, report generation, scheduling, watch management, exports, alerts, and account-affecting settings. This mismatch can mislead users and security reviewers about what the skill will actually do, undermining informed consent and increasing risk of unintended charges or account changes.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill metadata says it is only for static teardown of authorized product pages, but the code implements a much broader operational surface: monitoring, alerts, workbench actions, exports, competitor management, watch automation, and product-operations workflows. This scope mismatch is dangerous because an agent invoking the skill based on its manifest may perform account mutations, monitoring enrollment, paid actions, or broader data access the user did not reasonably authorize.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: These sections add persistent watches, scheduled monitoring, and recurring automation that exceed a one-time static teardown purpose. Persistent monitoring changes server-side state and can continue collecting or processing data after the initial user interaction, increasing consent, billing, and privacy risk.

Context-Inappropriate Capability

Medium

• Confidence: 80% confidence
• Finding: Benchmark and leaderboard functions move beyond static page teardown into category/ranking analysis, which the manifest explicitly says should not be used to prove bestseller status or market conclusions. This can mislead downstream agents into producing unsupported market claims and trigger paid queries outside expected scope.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: This code modifies autoconfirm behavior, and elsewhere the skill can mark alerts read, update workbench statuses, and manage watches—state-changing actions not justified by a static teardown manifest. Such hidden write capabilities are risky in agent settings because they can alter account behavior, billing controls, and operational records without informed user intent.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The module docstring promises paid commands require explicit --confirm after a preview/quote, but run_analysis() and cmd_voc() can auto-confirm and charge credits based on server flags. In agent usage, this undermines the user's consent model and can cause unexpected paid execution despite the documented safeguard.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The documentation presents the skill as an Amazon review analysis assistant, but the file later documents broader product watch and operations features. This mismatch can mislead users and reviewers about the actual scope of the installed capability, reducing informed consent and making over-privileged or unexpected actions more likely.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The skill documentation includes recurring monitoring and scheduled collection features, which exceed the declared 'static teardown only' purpose. This creates a capability expansion from one-time analysis into ongoing data collection, increasing the risk of unauthorized surveillance-like behavior, unexpected charges, and use beyond user expectations.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The documented watch functionality supports creating, pausing, resuming, deleting, and reading recurring product monitors, which is materially different from static page teardown. Persistent watch capabilities can be abused for continuous competitor tracking or repeated collection without users appreciating that the skill does more than ad hoc analysis.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: Operations audit and action-report workflows go beyond static teardown by enabling operational analysis and follow-on actions. This broader authority increases the chance that a user invokes powerful workflows under the mistaken belief that the skill only performs passive page decomposition.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: Alerts, workbench, AI advice, benchmarking, leaderboard, and competitor radar features significantly broaden the skill from static teardown into monitoring, decision support, and competitive intelligence workflows. Such undeclared breadth increases the risk of unexpected data processing, charges, and use of capabilities the user did not knowingly authorize.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The documentation includes authorization, account connection, balance checking, and billing-rule configuration capabilities that are not obviously necessary for a static teardown-only skill. Even if legitimate for paid services, combining them with an underscoped manifest weakens transparency and may enable account-affecting actions users did not expect from this skill.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The natural-language trigger is broad enough to capture generic Amazon review-analysis requests and then route them into a skill that can invoke remote APIs and potentially paid workflows. Overbroad activation increases the chance that users asking for a simple summary unknowingly enter a higher-privilege tool path with side effects such as collection, report creation, or account reads.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The fixed-entry section says this entrance is prioritized over the parent VOC workflow, but it does not clearly distinguish when teardown should be used versus the more general workflow. Ambiguous routing can cause the agent to select a broader or cost-bearing workflow unexpectedly, which is especially risky in a skill that includes billing-sensitive operations and external API use.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. 运行 `check`，确认账户、邮箱验证状态和可用积点。
2. 用户要 VOC / 评论分析报告时，默认运行 `voc <ASIN> --site <站点>`。
   **返回里有 `autoConfirmed: true` 就说明已经直接生成了**（1.4.5 起：服务端对前几次小额
   付费操作免确认，用户先拿到结果再谈钱），此时把报告讲给用户，并转述 `autoConfirmNote`
   （本次扣了多少、还剩几次免确认、之后会先问）。**不要在拿到结果后再补问「要不要生成」。**
3. 返回 `confirmationRequired: true` 才需要用户确认：报出 `totalCredits` 与余额，

• Confidence: 95% confidence
• Finding: The skill permits automatic generation of a paid VOC report when the backend marks the request as auto-confirmed, explicitly instructing the agent not to ask the user again. Even if the backend supports this policy, it removes an immediate user-consent checkpoint at the moment of spend and can lead to unintended charges triggered from natural-language requests.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. 运行 `check`，确认账户、邮箱验证状态和可用积点。
2. 用户要 VOC / 评论分析报告时，默认运行 `voc <ASIN> --site <站点>`。
   **返回里有 `autoConfirmed: true` 就说明已经直接生成了**（1.4.5 起：服务端对前几次小额
   付费操作免确认，用户先拿到结果再谈钱），此时把报告讲给用户，并转述 `autoConfirmNote`
   （本次扣了多少、还剩几次免确认、之后会先问）。**不要在拿到结果后再补问「要不要生成」。**
3. 返回 `confirmationRequired: true` 才需要用户确认：报出 `totalCredits` 与余额，
   用户同意后运行 `voc <ASIN> --site <站点> --confirm`。该命令会自动补齐采集、等待任务完成、

• Confidence: 94% confidence
• Finding: This workflow defaults to executing `voc <ASIN> --site <站点>` in response to a user asking for analysis, relying on the backend to decide whether the action immediately creates a paid report. That design shifts spending control away from the user and toward service-side auto-confirm logic, creating a real risk of unanticipated billing from ordinary conversational requests.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

用户只说自然语言。网页是补充视图（图表、分享链接、海报），不是把人送走的地方。

**确认与扣点**
- 报价返回 `autoConfirm: true` 时直接生成，不要再问「要不要」。生成后一句话交代：本次扣了多少、
  还剩几次免确认（或「免费版小额不问」）。策略由服务端决定：免费版小额不问；付费版前几次不问，之后先问。
- 用户说「以后别问了 / 50 以内直接做」→ 运行 `autoconfirm 50`；说「以后每次先问我」→ `autoconfirm off`；
  说「恢复默认」→ `autoconfirm default`。这是唯一需要你代用户设置的东西，设完复述一句当前规则。

• Confidence: 95% confidence
• Finding: The confirmation policy explicitly directs the agent to proceed with chargeable generation whenever `autoConfirm: true` is returned, without re-confirming with the user. In a conversational interface, this is dangerous because intent ambiguity is common, and automatic spending based on backend policy can be exploited by prompt phrasing or user misunderstanding.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**确认与扣点**
- 报价返回 `autoConfirm: true` 时直接生成，不要再问「要不要」。生成后一句话交代：本次扣了多少、
  还剩几次免确认（或「免费版小额不问」）。策略由服务端决定：免费版小额不问；付费版前几次不问，之后先问。
- 用户说「以后别问了 / 50 以内直接做」→ 运行 `autoconfirm 50`；说「以后每次先问我」→ `autoconfirm off`；
  说「恢复默认」→ `autoconfirm default`。这是唯一需要你代用户设置的东西，设完复述一句当前规则。
- 报价需要确认时，只说两个数：这次多少积点、余额多少，然后等用户一个「好」。采集是**固定单价**：直接说「15 积点/页 × 3 页 = 45 积点」，不要说成「预计 / 最多」——价格不会浮动；商品评论不够这么多页时只收实际采到的页数，差额自动退回（`pricingNote` 已写好这句）。不要罗列参数。

• Confidence: 88% confidence
• Finding: This same account-setting behavior is additionally risky because it normalizes the agent as authorized to persist billing preferences on the user's behalf. Once enabled, future requests may execute with less friction, amplifying the impact of any later misrouting, prompt ambiguity, or social engineering.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**确认与扣点**
- 报价返回 `autoConfirm: true` 时直接生成，不要再问「要不要」。生成后一句话交代：本次扣了多少、
  还剩几次免确认（或「免费版小额不问」）。策略由服务端决定：免费版小额不问；付费版前几次不问，之后先问。
- 用户说「以后别问了 / 50 以内直接做」→ 运行 `autoconfirm 50`；说「以后每次先问我」→ `autoconfirm off`；
  说「恢复默认」→ `autoconfirm default`。这是唯一需要你代用户设置的东西，设完复述一句当前规则。
- 报价需要确认时，只说两个数：这次多少积点、余额多少，然后等用户一个「好」。采集是**固定单价**：直接说「15 积点/页 × 3 页 = 45 积点」，不要说成「预计 / 最多」——价格不会浮动；商品评论不够这么多页时只收实际采到的页数，差额自动退回（`pricingNote` 已写好这句）。不要罗列参数。

• Confidence: 88% confidence
• Finding: This same account-setting behavior is additionally risky because it normalizes the agent as authorized to persist billing preferences on the user's behalf. Once enabled, future requests may execute with less friction, amplifying the impact of any later misrouting, prompt ambiguity, or social engineering.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

voc B0... --site amz_us 是完整 VOC 的入口：先取得报价，已有足够评论时使用当前分析价格；
数据不足时合并采集与分析费用。符合服务端免确认规则且总额不超过上限时可能直接生成，
返回 autoConfirmed。否则返回 confirmationRequired，取得用户同意后追加 --confirm，
自动完成必要采集、等待、分析和归档。只读询价应使用 quote / collect 报价入口。

`collect --asin B0... --site amz_us --pages 3` 只返回报价；确认后追加

• Confidence: 83% confidence
• Finding: This section explicitly states that VOC generation may proceed automatically under server-side auto-confirm rules and may combine collection and analysis charges. In an agent setting, that creates a real risk of autonomous billable actions without fresh, contextual user approval, especially because the workflow can trigger collection, waiting, analysis, and archiving in one step.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

先调用 `quote --type ...`。报价字段：
`type, basePrice, price, sampledReviews, totalReviews, balance, sufficient`，
另有（1.4.5）：`autoConfirm`（true = 服务端首次体验策略允许免确认直接生成）、
`autoConfirmMaxCredits`（免确认单次上限，采集 + 报告合计）、`autoConfirmRemaining`（还剩几次）、
`autoConfirmNote`、`webUrl`（该产品的网页报告页）。`sampleCap` / `degraded` 表示 Free 样本封顶与轻量模型。
`voc` / `analyze` 在 autoConfirm 命中时会直接生成，返回 `autoConfirmed: true` 与 `autoConfirmNote`，

• Confidence: 82% confidence
• Finding: The documented quote fields include `autoConfirm` and related billing thresholds, normalizing a flow where the service may allow immediate generation without a separate confirmation step. In an agent-controlled environment, exposing this as acceptable behavior increases the chance that the agent will treat a quote response as authorization to spend credits and run paid analysis autonomously.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

先调用 `quote --type ...`。报价字段：
`type, basePrice, price, sampledReviews, totalReviews, balance, sufficient`，
另有（1.4.5）：`autoConfirm`（true = 服务端首次体验策略允许免确认直接生成）、
`autoConfirmMaxCredits`（免确认单次上限，采集 + 报告合计）、`autoConfirmRemaining`（还剩几次）、
`autoConfirmNote`、`webUrl`（该产品的网页报告页）。`sampleCap` / `degraded` 表示 Free 样本封顶与轻量模型。
`voc` / `analyze` 在 autoConfirm 命中时会直接生成，返回 `autoConfirmed: true` 与 `autoConfirmNote`，
并附 `web.report` / `web.product` 网页链接。

• Confidence: 84% confidence
• Finding: This is a duplicate hit on the same line describing immediate execution under `autoConfirm`. The danger remains the same: the documentation legitimizes autonomous paid analysis unless the agent adds its own stronger consent controls.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

先调用 `quote --type ...`。报价字段：
`type, basePrice, price, sampledReviews, totalReviews, balance, sufficient`，
另有（1.4.5）：`autoConfirm`（true = 服务端首次体验策略允许免确认直接生成）、
`autoConfirmMaxCredits`（免确认单次上限，采集 + 报告合计）、`autoConfirmRemaining`（还剩几次）、
`autoConfirmNote`、`webUrl`（该产品的网页报告页）。`sampleCap` / `degraded` 表示 Free 样本封顶与轻量模型。
`voc` / `analyze` 在 autoConfirm 命中时会直接生成，返回 `autoConfirmed: true` 与 `autoConfirmNote`，
并附 `web.report` / `web.product` 网页链接。

• Confidence: 84% confidence
• Finding: This is a duplicate hit on the same line describing immediate execution under `autoConfirm`. The danger remains the same: the documentation legitimizes autonomous paid analysis unless the agent adds its own stronger consent controls.

Static analysis

No suspicious patterns detected.