Security audit
Security checks for vulnerabilities and agentic risk
This static comparison skill includes broader account controls and can trigger paid analysis through commands described as quote-only.
Ask the publisher for a version that enforces the comparison-only scope and preserves quote-only behavior. Until then, set the account to ask before each charge and approve recurring collection separately; omitting --confirm alone is insufficient.
scripts/ari.pyRecurring paid collection can be enabled without an enforced confirmation gate
Recurring collection can consume account credits beyond the current analysis without a technically enforced confirmation step.
scripts/ari.pyQuote-only deepdive paths can automatically execute paid analysis
Account credits can be consumed during a command documented as non-charging by default. The missing-subscription downgrade also fails to prevent paid execution and can subsequently claim that no credits were charged.
The file combines a fixed, explicitly confirmed feature-comparison workflow with instructions to invoke general-purpose paid workflows, sometimes before disclosing their cost. This conflicting operational guidance creates a credible route to out-of-scope account actions and credit consumption, although the final fixed-entry restriction and monitoring consent requirements mitigate some paths.
Persistent paid monitoring is outside the stated static-comparison scope, yet the skill supplies executable instructions for creating and managing it. Explicit pricing and consent requirements substantially reduce unauthorized-charge risk, but do not resolve the conflict with the fixed-only entry point.
The skill describes collection that defaults new products to weekly billing despite declaring a one-time static workflow. Instructions to use manual collection without recurring authorization are useful safeguards, but retaining default-on recurring functionality creates an avoidable risk of unintended ongoing charges.
This overlaps the recurring-watch scope issue: the static skill includes instructions for persistent, billable monitoring and lifecycle changes. The requirement for explicit price acceptance mitigates direct billing abuse, but the specialized entry point is not consistently maintained.
Persistent watch creation and lifecycle management exceed the fixed static-comparison entry point and can affect ongoing charges or monitoring availability. Explicit user consent, price acceptance, and deletion-target checks reduce the risk; this is an overlapping scope-control weakness, not evidence that those checks are bypassed.
The command requests a category-level ranking, with no primary ASIN or authorized competitor set specified. This materially differs from the declared static feature-comparison purpose. The implementation of ari.py is not supplied, so the precise meaning of neg_rate, any API access, and any side effects of --confirm cannot be verified; in particular, the snippet does not establish inference of actual return rates.
The comparison workflow says that binding a competitor enables weekly automatic collection, without attaching a specific recurring-cost consent step to that binding instruction. Authorization to compare or associate a competitor is not necessarily authorization for ongoing paid collection; general scheduling safeguards reduce but do not eliminate this ambiguity.
这些命令面向 watch 监控功能的报价和列表管理，而非所声明的静态商品特性与评论证据对照，属于未声明的能力。片段仅展示使用命令，未提供底层实现，因此不能据此认定其实际执行了定时刷新，或进行了销量等被排除事项的推断。
Watch pricing and monitoring-configuration inspection are not described by the declared static product-feature comparison purpose. The supplied commands do not perform the stated comparison workflow. This assessment is limited to the visible invocations; they do not establish that monitoring is enabled or modified.
The supplied commands expose temporal monitoring functionality organized around a watch ID, rather than static comparison of product attributes and review evidence. The seven-day digest and 90-day series are outside the explicitly static scope. The snippet does not reveal the monitored metrics, so it does not establish sales, inventory, advertising, order, or return-rate analysis.
The declared scope is limited to static product-feature comparison, whereas the supplied command selects an alerts operation. This indicates an undeclared capability. Because the implementation of scripts/ari.py is unavailable, the alert contents, accessed resources, and possible side effects cannot be determined; no specific sales, inventory, advertising, or order access is established.
The supplied command targets an individual review through an advise workflow rather than requesting an ASIN-based feature comparison. This indicates a materially different operation from the declared purpose. However, the script implementation is not supplied, so the command alone does not establish whether it modifies data, contacts external services, or performs any particular downstream action.
An unanswered quote and an idle product are explicitly used as grounds to generate a report in a later conversation. Silence does not authorize spending, and server-side automatic confirmation may consume credits without a current request or user-approved spending mandate.
run_analysis changes confirm from false to true when the server supplies a truthy autoConfirm value and sufficient balance. This allows a supposedly preview-only invocation, including deepdive paths intended to be quote-only, to generate paid analysis without the explicit --confirm promised by the module.
The reported line range does not identify the policy setter, but cmd_autoconfirm elsewhere in this file can change account-wide paid-operation confirmation settings without a separate confirmation step. That exceeds a static comparison skill's purpose and can weaken safeguards for later spending; reachability depends on the unavailable allowedCommands configuration.
Collection defaults to weekly paid collection even though this specialized skill promises a static feature comparison. The quote discloses recurrence and collection normally requires confirmation, which mitigates the risk, but an agent can still interpret approval of one collection as authorization for continuing charges.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 重新发布：各市场首批上架的 1.5.0 包早于免确认修复，新注册的免费版用户仍会被要求先确认报价。
1.5.1 与当前官网下发的修复版一致，市场侧以新版本号覆盖旧包。
- 免确认只认服务端报价返回的 `autoConfirm`；采集报价扣除首次采集免费页；
非美国站首次采集可用赠送积点时不再提示「赠送积点不可用」（行为与修复后的 1.5.0 相同）。
- 命令、字段与计费规则不变，不提高最低支持版本。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 行为变更：新用户（注册并验证邮箱后）第一次要 VOC，只给 ASIN 即可（站点默认美国站），
`voc` 直接执行——自动补采集（默认 3 页）、生成报告、按服务端定价扣费并归档，
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
为 true 时赠送积点计入 `nonUsCollectCredits`、`siteNote` 为空；UK/DE/JP 卖家的第一份 VOC 同样一步直出。
- 余额不足仍在执行前拦截（402）并引导充值；定价以服务端配置为准，代码常量仅为兜底。
- 一致性：`analyze` 各类型（insight / keywords / trend / variant / compare）走同一口径，
`autoConfirm=true` 即直接生成并返回 `charges`。
- 文档：移除所有写死的单价与合计示例。采集/分析单价与页数由后台 `pricing` 配置决定，
一律以本次报价返回的 `credits` / `totalCredits` 为准，不得凭文档或记忆报数。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 能力层收窄：44 个专属包不再只是「声明窄」，包体 `scripts/ari.py` 同时按各自契约裁剪。
构建期用 AST 删除文档未承诺的命令、它们的解析器注册块，以及只被它们引用的辅助函数与
常量；专属包因此不再包含 `export`（任意路径写文件）、`autoconfirm`（撤销逐次确认）、
`workbench`（改写差评处理状态）、`alerts`（标记预警已读）、`competitors`、`schedule`、
`voc` / `analyze` / `charts` / `deepdive` 等母版命令。
- 新增运行期兜底闸：专属包在包内写入 `allowedCommands` 白名单，`ari.py`
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
p = sub.add_parser("autoconfirm", parents=[common],
help="免确认阈值：autoconfirm 50 / autoconfirm off / autoconfirm default；不带参数查看")
p.add_argument("value", nargs="?", default="")
p.set_defaults(fn=cmd_autoconfirm)
p = sub.add_parser("version", parents=[common], help="显示 Skill 版本与渠道（无需 Key）")
p.set_defaults(fn=cmd_version)
Without declared permissions the skill's intent is opaque and cannot be validated.
The skill treats server-defined first-use exemptions, including exemptions without an amount limit, as sufficient authority to collect, generate, and deduct credits. A service's willingness to execute is not equivalent to informed user authorization, particularly when this skill separately promises quotation and explicit confirmation.
`voc <ASIN>`（没说站点就用默认的美国站，不要为此追问）。
命中服务端免确认规则（新用户首次体验不看金额 / 账户剩余免确认次数 / 用户自设阈值）且余额充足时，
**直接完成采集 + 生成 + 扣点并归档**，不再停在报价环节。绝不能描述成“先帮你问个价 / 只报价不扣点”。
免确认与否以返回里的 `autoConfirm` 为准，不要自己从提示文案里猜。
- 直接生成成功后，返回结果带 `charges`（采集扣点、分析扣点、合计、扣前/扣后余额）与 `autoConfirmNote`。
**先讲报告，再用一句话转述实际扣点**，不要在拿到结果后再补问「要不要生成」，也不要回头补一次报价。
- 只有在返回 `confirmationRequired: true` 时（余额不足、或用户自行设置了“每次先问”）