Amazon 竞品变化监控

• Outcome: Review
• Latest audit: Sep 8, 2026 · 5:34 AM UTC
• Version: 1.4.8

Overview

The skill presents as a deterministic Amazon competitor-watch tool, but it ships a much broader ARI CLI that can perform paid AI analysis, exports, and account/workbench operations beyond the advertised monitor.

Review before installing. Use this only if you are comfortable giving ARI an API key, creating server-side daily or weekly watches, and having a broad ARI CLI present in the package. For monitor use, keep agents to the documented watch commands, disable or avoid autoconfirm for paid actions, and do not invoke analyze, voc, export, workbench, or operations unless you separately intend those actions and costs.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill exposes shell, network, environment, and file-write capabilities while declaring no permissions, which weakens reviewability and user consent. Even if the documented workflow is narrow, undeclared capabilities can enable access to local secrets, outbound requests, or filesystem changes beyond what users expect.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The skill claims it is limited to deterministic competitor-watch operations, but the referenced CLI surface appears to expose many additional functions including credential setup, account management, exports, review collection, and paid AI analysis. This mismatch is dangerous because users and security reviewers may authorize a narrowly scoped monitor while the implementation can invoke broader, cost-bearing, or data-exporting operations.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The implementation exposes a much broader capability set than the declared skill purpose of deterministic competitor change monitoring, including paid AI analysis, review collection, exports, operations tooling, alerts, and workbench flows. In an agent ecosystem, this scope mismatch is dangerous because orchestration and user trust decisions may rely on the manifest, allowing a seemingly narrow skill to trigger unrelated network actions, paid operations, and data handling paths.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This code performs paid AI/LLM-style analysis via /api/v1/analysis/* despite the manifest stating the skill does not automatically call paid LLMs. That discrepancy is risky because policy engines or users may permit the skill under the assumption that it is deterministic and non-LLM, while the code can in fact incur charges and send data into AI analysis workflows.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The one-command VOC flow chains collection and AI analysis together and can auto-confirm under some conditions, exceeding the declared deterministic monitor-only scope. Bundling multiple billable, networked actions into a single command increases the chance that an agent or user invokes expensive or broader-than-expected behavior based on misleading skill metadata.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: Product-operations workflows are functionally distinct from competitor change monitoring and materially broaden what the skill can do with authorized data. In a constrained skill environment, this unjustified expansion undermines least privilege and can lead agents to invoke operational analysis capabilities the user did not intend to grant.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The negative-review workbench and AI advice generation features are unrelated to the stated monitoring purpose and introduce additional analysis and paid-generation capabilities. Even if individually legitimate, they create unnecessary privilege and behavioral expansion relative to the manifest, which is dangerous in delegated agent use.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: Local export capability is broader than necessary for a monitoring-only skill and enables writing downloaded data to arbitrary local file paths chosen by the caller. In an agent context this increases data exfiltration and filesystem side-effect risk beyond the narrow declared purpose, even though the code does not itself overwrite protected paths intentionally.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

if not ok(quote):
        return quote
    q_data = data_of(quote) or {}
    # 首次体验免确认（服务端策略 skill.autoConfirm）：前几次小额直接生成，不再多问一轮。
    auto_confirmed = False
    if not confirm and q_data.get("autoConfirm") and q_data.get("sufficient"):
        confirm = True

• Confidence: 97% confidence
• Finding: This analysis path can convert a non-confirmed request into a confirmed paid action when the server reports autoConfirm and sufficient balance. In an agent setting, that weakens the local guarantee that billable analysis only runs after explicit per-request consent, especially problematic given the manifest's narrow non-LLM framing.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

return quote
    q_data = data_of(quote) or {}
    # 首次体验免确认（服务端策略 skill.autoConfirm）：前几次小额直接生成，不再多问一轮。
    auto_confirmed = False
    if not confirm and q_data.get("autoConfirm") and q_data.get("sufficient"):
        confirm = True
        auto_confirmed = True

• Confidence: 97% confidence
• Finding: Setting auto_confirmed marks that the code has decided to proceed with a paid operation without an explicit current command confirmation. This creates a consent boundary issue for delegated or automated use.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

q_data = data_of(quote) or {}
    # 首次体验免确认（服务端策略 skill.autoConfirm）：前几次小额直接生成，不再多问一轮。
    auto_confirmed = False
    if not confirm and q_data.get("autoConfirm") and q_data.get("sufficient"):
        confirm = True
        auto_confirmed = True
    if not confirm:

• Confidence: 97% confidence
• Finding: The conditional on q_data.get('autoConfirm') is the decision point that bypasses explicit user confirmation for paid analysis. In contexts where the agent is expected to avoid autonomous purchases or billable actions, this is a real policy and consent risk.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

if plan is not None and plan["balance"]["note"]:
        combined_quote["siteNote"] = plan["balance"]["note"]
    combined_quote["webUrl"] = analysis_quote.get("webUrl")
    # 首次体验免确认：服务端 autoConfirm=true 且「采集 + 报告」合计不超过单次上限时，直接跑完。
    # 在聊天里多问一句「确认吗」，很多用户就不回了——先让他拿到结果。
    auto_max = int(analysis_quote.get("autoConfirmMaxCredits") or 0)
    auto_confirmed = (not args.confirm and bool(analysis_quote.get("autoConfirm"))

• Confidence: 98% confidence
• Finding: The VOC command computes a condition under which collection plus analysis may run automatically without explicit --confirm. Because this combined flow can trigger multiple billable operations in one command, autonomous execution materially increases consent and spending risk.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

combined_quote["webUrl"] = analysis_quote.get("webUrl")
    # 首次体验免确认：服务端 autoConfirm=true 且「采集 + 报告」合计不超过单次上限时，直接跑完。
    # 在聊天里多问一句「确认吗」，很多用户就不回了——先让他拿到结果。
    auto_max = int(analysis_quote.get("autoConfirmMaxCredits") or 0)
    auto_confirmed = (not args.confirm and bool(analysis_quote.get("autoConfirm"))
                      and sufficient and total_credits <= auto_max)
    if not args.confirm and not auto_confirmed:

• Confidence: 98% confidence
• Finding: This condition explicitly enables automatic paid execution based on server-provided autoConfirm metadata and price thresholds. In an agent-mediated environment, that permits the skill to turn a nominal preview command into a billable action without a fresh user approval step.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

# 首次体验免确认：服务端 autoConfirm=true 且「采集 + 报告」合计不超过单次上限时，直接跑完。
    # 在聊天里多问一句「确认吗」，很多用户就不回了——先让他拿到结果。
    auto_max = int(analysis_quote.get("autoConfirmMaxCredits") or 0)
    auto_confirmed = (not args.confirm and bool(analysis_quote.get("autoConfirm"))
                      and sufficient and total_credits <= auto_max)
    if not args.confirm and not auto_confirmed:
        combined_quote["autoConfirmRemaining"] = analysis_quote.get("autoConfirmRemaining")

• Confidence: 98% confidence
• Finding: The auto_confirmed state here governs whether the command returns a quote or proceeds to collection and VOC generation. That means explicit consent can be bypassed for a multi-operation paid workflow, which is unsafe in delegated execution contexts.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

# 首次体验免确认：服务端 autoConfirm=true 且「采集 + 报告」合计不超过单次上限时，直接跑完。
    # 在聊天里多问一句「确认吗」，很多用户就不回了——先让他拿到结果。
    auto_max = int(analysis_quote.get("autoConfirmMaxCredits") or 0)
    auto_confirmed = (not args.confirm and bool(analysis_quote.get("autoConfirm"))
                      and sufficient and total_credits <= auto_max)
    if not args.confirm and not auto_confirmed:
        combined_quote["autoConfirmRemaining"] = analysis_quote.get("autoConfirmRemaining")

• Confidence: 98% confidence
• Finding: The auto_confirmed state here governs whether the command returns a quote or proceeds to collection and VOC generation. That means explicit consent can be bypassed for a multi-operation paid workflow, which is unsafe in delegated execution contexts.

Static analysis

No suspicious patterns detected.