ClawHub
Back to skill

Security audit

亚马逊品牌口碑监控 · 评论舆情追踪

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its Amazon review-monitoring purpose, but it can spend ARI credits automatically under auto-confirm rules and change future confirmation settings.

Review before installing if you want strict control over paid actions. Use this only if you are comfortable sending Amazon ASIN/review and account data to ARI, storing an ARI API key locally, and managing persistent ARI settings. Consider saying “only quote, do not execute” or setting autoconfirm off before running paid reports.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (72)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md
- CLI：本 Skill 目录下的 `scripts/ari.py`。在 Skill 根目录执行，例如

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md
- CLI：本 Skill 目录下的 `scripts/ari.py`。在 Skill 根目录执行，例如

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md
- CLI：本 Skill 目录下的 `scripts/ari.py`。在 Skill 根目录执行，例如

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md
- CLI：本 Skill 目录下的 `scripts/ari.py`。在 Skill 根目录执行，例如

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.

md
- CLI：本 Skill 目录下的 `scripts/ari.py`。在 Skill 根目录执行，例如

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 198)May include surrounding context.

md
- CLI：本 Skill 目录下的 `scripts/ari.py`。在 Skill 根目录执行，例如

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 199)May include surrounding context.

md
- CLI：本 Skill 目录下的 `scripts/ari.py`。在 Skill 根目录执行，例如

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 200)May include surrounding context.

md
- CLI：本 Skill 目录下的 `scripts/ari.py`。在 Skill 根目录执行，例如

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.

md
- CLI：本 Skill 目录下的 `scripts/ari.py`。在 Skill 根目录执行，例如

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 202)May include surrounding context.

md
- CLI：本 Skill 目录下的 `scripts/ari.py`。在 Skill 根目录执行，例如

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 203)May include surrounding context.

md
- CLI：本 Skill 目录下的 `scripts/ari.py`。在 Skill 根目录执行，例如

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 204)May include surrounding context.

md
- CLI：本 Skill 目录下的 `scripts/ari.py`。在 Skill 根目录执行，例如

Lp1

High
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill performs authenticated network access to a remote service and device-auth flows, yet the finding indicates network capability is not covered by declared permissions. Even with strong destination validation to ari.funewa.com and redirect blocking, undeclared network access is a real security/governance issue because it can transmit user data and credentials outside the local environment.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill performs authenticated network access to a remote service and device-auth flows, yet the finding indicates network capability is not covered by declared permissions. Even with strong destination validation to ari.funewa.com and redirect blocking, undeclared network access is a real security/governance issue because it can transmit user data and credentials outside the local environment.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill performs authenticated network access to a remote service and device-auth flows, yet the finding indicates network capability is not covered by declared permissions. Even with strong destination validation to ari.funewa.com and redirect blocking, undeclared network access is a real security/governance issue because it can transmit user data and credentials outside the local environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The entire user-facing changelog content is written in Chinese, which effectively forces a specific language/locale for readers without indicating any user choice or opt-in. Under the policy, language constraints should either offer a choice or be clearly documented as justified region-specific behavior.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · CHANGELOG.md (reported line 23)May include surrounding context.

md
- 能力层收窄：44 个专属包不再只是「声明窄」，包体 `scripts/ari.py` 同时按各自契约裁剪。
  构建期用 AST 删除文档未承诺的命令、它们的解析器注册块，以及只被它们引用的辅助函数与
  常量；专属包因此不再包含 `export`（任意路径写文件）、`autoconfirm`（撤销逐次确认）、
  `workbench`（改写差评处理状态）、`alerts`（标记预警已读）、`competitors`、`schedule`、
  `voc` / `analyze` / `charts` / `deepdive` 等母版命令。
- 新增运行期兜底闸：专属包在包内写入 `allowedCommands` 白名单，`ari.py`

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/ari.py (reported line 1805)May include surrounding context.

python
- 能力层收窄：44 个专属包不再只是「声明窄」，包体 `scripts/ari.py` 同时按各自契约裁剪。
  构建期用 AST 删除文档未承诺的命令、它们的解析器注册块，以及只被它们引用的辅助函数与
  常量；专属包因此不再包含 `export`（任意路径写文件）、`autoconfirm`（撤销逐次确认）、
  `workbench`（改写差评处理状态）、`alerts`（标记预警已读）、`competitors`、`schedule`、
  `voc` / `analyze` / `charts` / `deepdive` 等母版命令。
- 新增运行期兜底闸：专属包在包内写入 `allowedCommands` 白名单，`ari.py`

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/ari.py (reported line 1806)May include surrounding context.

python
- 能力层收窄：44 个专属包不再只是「声明窄」，包体 `scripts/ari.py` 同时按各自契约裁剪。
  构建期用 AST 删除文档未承诺的命令、它们的解析器注册块，以及只被它们引用的辅助函数与
  常量；专属包因此不再包含 `export`（任意路径写文件）、`autoconfirm`（撤销逐次确认）、
  `workbench`（改写差评处理状态）、`alerts`（标记预警已读）、`competitors`、`schedule`、
  `voc` / `analyze` / `charts` / `deepdive` 等母版命令。
- 新增运行期兜底闸：专属包在包内写入 `allowedCommands` 白名单，`ari.py`

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/ari.py (reported line 1808)May include surrounding context.

python
- 能力层收窄：44 个专属包不再只是「声明窄」，包体 `scripts/ari.py` 同时按各自契约裁剪。
  构建期用 AST 删除文档未承诺的命令、它们的解析器注册块，以及只被它们引用的辅助函数与
  常量；专属包因此不再包含 `export`（任意路径写文件）、`autoconfirm`（撤销逐次确认）、
  `workbench`（改写差评处理状态）、`alerts`（标记预警已读）、`competitors`、`schedule`、
  `voc` / `analyze` / `charts` / `deepdive` 等母版命令。
- 新增运行期兜底闸：专属包在包内写入 `allowedCommands` 白名单，`ari.py`

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The README is entirely written in Chinese and all example invocations are Chinese-only, which implies the skill expects or defaults to a specific language. There is no indication that users may choose another language or that the Chinese-only scope is a justified locale constraint.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
95% confidence
Finding

The skill instructs the agent to initiate a potentially billable VOC operation by default based on user intent, relying on a server-side auto-confirm path that may charge the account before explicit confirmation in the current conversation. This weakens user consent boundaries and creates a risk of unintended spend, especially when the skill is invoked by broad natural-language requests.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md
1. 运行 `check`，确认账户、邮箱验证状态和可用积点。
2. 用户要 VOC / 评论分析报告时，默认运行 `voc <ASIN> --site <站点>`。
   **返回里有 `autoConfirmed: true` 就说明已经直接生成了**（1.4.5 起：服务端对前几次小额
   付费操作免确认，用户先拿到结果再谈钱），此时把报告讲给用户，并转述 `autoConfirmNote`
   （本次扣了多少、还剩几次免确认、之后会先问）。**不要在拿到结果后再补问「要不要生成」。**
3. 返回 `confirmationRequired: true` 才需要用户确认：报出 `totalCredits` 与余额，

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
95% confidence
Finding

This line explicitly instructs running a confirm flag after minimal confirmation wording, and the surrounding workflow normalizes automatic progression from user request to billable execution. If the user intent is ambiguous or the cost context is not sufficiently clear, the agent may authorize charges too easily.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md
1. 运行 `check`，确认账户、邮箱验证状态和可用积点。
2. 用户要 VOC / 评论分析报告时，默认运行 `voc <ASIN> --site <站点>`。
   **返回里有 `autoConfirmed: true` 就说明已经直接生成了**（1.4.5 起：服务端对前几次小额
   付费操作免确认，用户先拿到结果再谈钱），此时把报告讲给用户，并转述 `autoConfirmNote`
   （本次扣了多少、还剩几次免确认、之后会先问）。**不要在拿到结果后再补问「要不要生成」。**
3. 返回 `confirmationRequired: true` 才需要用户确认：报出 `totalCredits` 与余额，
   用户同意后运行 `voc <ASIN> --site <站点> --confirm`。该命令会自动补齐采集、等待任务完成、

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
97% confidence
Finding

The instruction to proceed when autoConfirm: true means the skill is designed to let backend policy override interactive user confirmation for billable actions. In a conversational agent context, this is dangerous because a broad trigger plus auto-execution can convert exploratory questions into charged operations without fresh consent.

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

md
用户只说自然语言。网页是补充视图（图表、分享链接、海报），不是把人送走的地方。

**确认与扣点**
- 报价返回 `autoConfirm: true` 时直接生成，不要再问「要不要」。生成后一句话交代：本次扣了多少、
  还剩几次免确认（或「免费版小额不问」）。策略由服务端决定：免费版小额不问；付费版前几次不问，之后先问。
- 用户说「以后别问了 / 50 以内直接做」→ 运行 `autoconfirm 50`；说「以后每次先问我」→ `autoconfirm off`；
  说「恢复默认」→ `autoconfirm default`。这是唯一需要你代用户设置的东西，设完复述一句当前规则。

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
93% confidence
Finding

Allowing the agent to change persistent autoconfirm settings on behalf of the user alters future spending behavior and expands the blast radius beyond the current task. Even though the text says this is the only delegated setting, changing consent policy is security-sensitive because it modifies how later billable actions are authorized.

Content

Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.

md
**确认与扣点**
- 报价返回 `autoConfirm: true` 时直接生成，不要再问「要不要」。生成后一句话交代：本次扣了多少、
  还剩几次免确认（或「免费版小额不问」）。策略由服务端决定：免费版小额不问；付费版前几次不问，之后先问。
- 用户说「以后别问了 / 50 以内直接做」→ 运行 `autoconfirm 50`；说「以后每次先问我」→ `autoconfirm off`；
  说「恢复默认」→ `autoconfirm default`。这是唯一需要你代用户设置的东西，设完复述一句当前规则。
- 报价需要确认时，只说两个数：这次多少积点、余额多少，然后等用户一个「好」。采集是**固定单价**：直接说「15 积点/页 × 3 页 = 45 积点」，不要说成「预计 / 最多」——价格不会浮动；商品评论不够这么多页时只收实际采到的页数，差额自动退回（`pricingNote` 已写好这句）。不要罗列参数。