Security audit
Security checks for vulnerabilities and agentic risk
This page-audit skill also exposes broader commands that can spend credits or enable recurring collection without consistently obtaining approval first.
Prefer a package restricted to page audits. Require approval of each quoted cost, use manual collection for one-time work, and separately approve recurring collection. Do not assume that omitting --confirm guarantees a free preview.
scripts/ari.pyQuote-only deepdive can execute paid analysis
A user or agent relying on the preview contract can unintentionally spend credits. With a missing main-product subscription and --confirm, the output can additionally claim that analysis was downgraded to quote-only despite execution.
scripts/ari.pyRecurring paid collection lacks an executable confirmation gate
An agent invocation that omits the instructed consent step can activate future recurring credit deductions.
The page-audit skill contains actionable generic workflows for automatic spending, recurring collection, monitoring, and account-policy changes. Its final fixed-entry restriction mitigates this, but conflicts with earlier instructions to execute broader workflows and can cause unintended paid operations; the supplied document does not establish every implementation behavior listed by the scanner.
The supplied command targets a category leaderboard, not field completeness, wording consistency, or a comparative review-evidence issue list for specified products. This is a materially different operation and scope. The implementation of ari.py is not provided, so the precise meaning of neg_rate and any underlying data access cannot be established; in particular, this snippet alone does not demonstrate actual return-rate analysis.
Persistent watch creation and resumption introduce recurring financial side effects outside the stated audit purpose. The requirement for explicit acceptance of quoted prices is protective, so this is a conflicting-scope issue rather than evidence of a demonstrated billing-authorization bypass.
The snippet exposes watch-service pricing and listing functionality that the declared page-auditing purpose does not disclose. These costs may concern the watch service rather than product prices, so the explicit exclusion of real-time product-price analysis is not itself decisive. The mismatch is the additional watch-service functionality. The underlying CLI implementation is not supplied, so further data access or state changes cannot be established.
The document routes requests into persistent monitoring despite declaring a page-audit-only entry point. Explicit pricing and consent requirements reduce the risk of unauthorized charges, but conflicting scope instructions still expose an unintended recurring-billing workflow.
The included watch lifecycle commands can create persistent, paid monitoring outside the declared page-comparison workflow. Required price confirmation reduces exposure, but the contradiction with the fixed entry point remains an actionable scope-control defect.
The competitor-binding instructions state that adding a competitor enables weekly automatic collection, coupling a comparison setup action to a persistent side effect. General recurring-charge safeguards elsewhere help, but the binding step does not locally require separate disclosure and approval of that schedule.
Watch-service discovery, pricing estimates, and watch listing are distinct capabilities not disclosed by the page-auditing description. The snippet does not demonstrate product-page auditing or establish that these commands are necessary supporting steps. It also does not show real-time product pricing, sales, inventory, or other explicitly excluded data retrieval.
Recurring review collection is a persistent account change not needed for a one-time page audit. The document generally requires consent and manual collection when recurring authorization is absent, but including these conflicting operational paths creates avoidable risk of ongoing charges.
The commands expose temporal monitoring capabilities rather than the declared product-page completeness and evidence review. No page comparison or issue-list generation is shown. The underlying implementation and watched metrics are not supplied, so the snippet does not establish that excluded price, sales, inventory, or other operational data is accessed.
The supplied command selects an alerts operation rather than an identifiable page-review operation, indicating an undeclared capability. Confidence is limited because the implementation of alerts is unavailable: the snippet does not establish what alerts contain or whether any explicitly excluded operational data is accessed.
The standard workflow directs immediate VOC execution and accepts post-execution charging instead of the specialized audit's quote-and-confirm process. Although conditional on a VOC request, this competing routing path can turn an ambiguous review-analysis request into an unintended paid report.
The skill explicitly resumes an unanswered quotation in a later conversation and proceeds toward report generation without fresh approval. An idle product or previous quote establishes interest, not authorization, and server auto-confirm defaults can allow consumption of paid credits.
run_analysis changes confirm from false to true when the server returns sufficient funds and a truthy autoConfirm value, then submits a paid analysis. This contradicts the documented explicit-confirmation requirement and can make analyze or deepdive consume credits when the caller expects only a quote; command reachability depends on the unprovided skill-defaults.json.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 重新发布：各市场首批上架的 1.5.0 包早于免确认修复，新注册的免费版用户仍会被要求先确认报价。
1.5.1 与当前官网下发的修复版一致，市场侧以新版本号覆盖旧包。
- 免确认只认服务端报价返回的 `autoConfirm`；采集报价扣除首次采集免费页；
非美国站首次采集可用赠送积点时不再提示「赠送积点不可用」（行为与修复后的 1.5.0 相同）。
- 命令、字段与计费规则不变，不提高最低支持版本。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 行为变更：新用户（注册并验证邮箱后）第一次要 VOC，只给 ASIN 即可（站点默认美国站），
`voc` 直接执行——自动补采集（默认 3 页）、生成报告、按服务端定价扣费并归档，
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
为 true 时赠送积点计入 `nonUsCollectCredits`、`siteNote` 为空；UK/DE/JP 卖家的第一份 VOC 同样一步直出。
- 余额不足仍在执行前拦截（402）并引导充值；定价以服务端配置为准，代码常量仅为兜底。
- 一致性：`analyze` 各类型（insight / keywords / trend / variant / compare）走同一口径，
`autoConfirm=true` 即直接生成并返回 `charges`。
- 文档：移除所有写死的单价与合计示例。采集/分析单价与页数由后台 `pricing` 配置决定，
一律以本次报价返回的 `credits` / `totalCredits` 为准，不得凭文档或记忆报数。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
先调用 `quote --type ...`。报价字段：
`type, basePrice, price, sampledReviews, totalReviews, balance, sufficient`，
另有（1.4.5 起，1.5.0 调整）：`autoConfirm`（true = 服务端策略允许免确认直接生成）、
`autoConfirmRemaining`（还剩几次免确认，仅供转述）、`autoConfirmNote`（本次免确认说明，仅供转述）、
`webUrl`（该产品的网页报告页）。**是否直接生成只看 `autoConfirm`**，不要从 note 文案或 remaining 推断。
1.5.0 起服务端对前几次付费生成不看 `autoConfirmMaxCredits`，该字段**不再作为首次体验的硬拦截**，
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 能力层收窄：44 个专属包不再只是「声明窄」，包体 `scripts/ari.py` 同时按各自契约裁剪。
构建期用 AST 删除文档未承诺的命令、它们的解析器注册块，以及只被它们引用的辅助函数与
常量；专属包因此不再包含 `export`（任意路径写文件）、`autoconfirm`（撤销逐次确认）、
`workbench`（改写差评处理状态）、`alerts`（标记预警已读）、`competitors`、`schedule`、
`voc` / `analyze` / `charts` / `deepdive` 等母版命令。
- 新增运行期兜底闸：专属包在包内写入 `allowedCommands` 白名单，`ari.py`
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
p = sub.add_parser("check", parents=[common], help="验证 Key、账户和积点余额")
p.set_defaults(fn=cmd_check)
p = sub.add_parser("autoconfirm", parents=[common],
help="免确认阈值：autoconfirm 50 / autoconfirm off / autoconfirm default；不带参数查看")
p.add_argument("value", nargs="?", default="")
p.set_defaults(fn=cmd_autoconfirm)
Without declared permissions the skill's intent is opaque and cannot be validated.
The auto-confirm rules include provider-defined first-run exemptions without an amount limit, not just spending thresholds explicitly chosen by the user. Treating those exemptions as authorization can consume account credits before the user approves a cost, contrary to the audit's explicit-confirmation contract.
`voc <ASIN>`（没说站点就用默认的美国站，不要为此追问）。
命中服务端免确认规则（新用户首次体验不看金额 / 账户剩余免确认次数 / 用户自设阈值）且余额充足时，
**直接完成采集 + 生成 + 扣点并归档**，不再停在报价环节。绝不能描述成“先帮你问个价 / 只报价不扣点”。
免确认与否以返回里的 `autoConfirm` 为准，不要自己从提示文案里猜。
- 直接生成成功后，返回结果带 `charges`（采集扣点、分析扣点、合计、扣前/扣后余额）与 `autoConfirmNote`。
**先讲报告，再用一句话转述实际扣点**，不要在拿到结果后再补问「要不要生成」，也不要回头补一次报价。
- 只有在返回 `confirmationRequired: true` 时（余额不足、或用户自行设置了“每次先问”）
A server-provided autoConfirm flag is treated as sufficient authority to charge even when it reflects a first-run default rather than user consent. This duplicates the preceding authorization defect and can produce financial side effects before cost disclosure.
命中服务端免确认规则（新用户首次体验不看金额 / 账户剩余免确认次数 / 用户自设阈值）且余额充足时，
**直接完成采集 + 生成 + 扣点并归档**，不再停在报价环节。绝不能描述成“先帮你问个价 / 只报价不扣点”。
免确认与否以返回里的 `autoConfirm` 为准，不要自己从提示文案里猜。
- 直接生成成功后，返回结果带 `charges`（采集扣点、分析扣点、合计、扣前/扣后余额）与 `autoConfirmNote`。
**先讲报告，再用一句话转述实际扣点**，不要在拿到结果后再补问「要不要生成」，也不要回头补一次报价。
- 只有在返回 `confirmationRequired: true` 时（余额不足、或用户自行设置了“每次先问”）
才报出 `totalCredits` 与余额并等待同意，同意后追加 `--confirm`。