Security audit
Security checks for vulnerabilities and agentic risk
This price-comparison skill also exposes paid analysis and recurring collection, with conflicting instructions that can permit charges without fresh approval.
Prefer a corrected package that enforces its price-comparison scope and requires approval before spending. If already installed, require confirmation for every paid operation and review existing collection schedules and watches. The verified scope and consent problems warrant Review; the artifacts do not establish malicious intent.
scripts/ari.pyRecurring paid collection can be enabled without a confirmation gate
An Agent invocation made before obtaining the separately required consent can enable recurring collection and subsequent credit consumption beyond a one-time analysis request. The change persists until the schedule is changed or otherwise stopped.
A snapshot-comparison skill contains conflicting instructions to perform broad paid workflows, sometimes without advance cost confirmation. The final fixed-entry restriction mitigates this, but leaving contradictory operational instructions creates a credible route to unintended spending and scope expansion; not every code capability alleged by the scanner is independently verified.
The supplied commands concern product reviews rather than displayed-price snapshots. Review retrieval, sentiment filtering, helpfulness sorting, and requesting review images are not declared capabilities and do not implement the stated price-comparison purpose. The underlying script is not supplied, so this assessment is limited to the operations requested by the visible commands.
Schedule mutations can establish persistent collection and future charges beyond the fixed price-comparison workflow. The text requires authorization for changes, which reduces risk, but including these conflicting operational paths weakens the specialized skill's action boundary.
This duplicates the recurring-watch scope issue: the body exposes persistent billable operations despite the fixed snapshot-comparison entry point. Quotation and explicit user consent are meaningful safeguards, but they do not resolve the contradictory capability boundary.
The reviews command exposes a distinct, undeclared capability rather than an implementation detail supporting price-snapshot comparison. The charts command is also not explained by the description, although its precise data scope cannot be determined without the script implementation. The snippet does not establish live pricing, sales, inventory, ordering, or automated repricing behavior.
The text explicitly directs VOC collection and report generation, not merely an ambiguously named command. Those instructions can incur charges without advance confirmation under server defaults, conflicting with the specialized entry point's requirement for an explicit quote and approval.
This is another instance of the VOC scope and charging conflict. A price-snapshot entry point should not also instruct the agent to launch review collection and analysis using default no-confirmation rules.
The skill includes a paid category-leaderboard workflow outside its fixed price-comparison operation. The explicit quotation and confirmation requirement limits the billing risk, and the negative-review ranking itself is not a security problem.
This repeats the exposure of recurring paid watch operations outside the fixed snapshot-comparison workflow. Explicit pricing acceptance and user confirmation mitigate unauthorized billing, but contradictory instructions still permit operational scope expansion.
Persistent paid watch creation and management exceed the specialized snapshot-comparison entry point and conflict with its fixed-workflow restriction. Explicit quotation and consent requirements reduce the likelihood of unauthorized charges, so the risk is narrower than the scanner's high rating suggests.
The competitor-binding instructions state that adding a competitor enables weekly collection, introducing a persistent side effect beyond comparing existing snapshots. This subsection does not clearly require separate approval of that recurring collection, although broader authorization safeguards partially mitigate the risk.
The supplied commands concern watch-service quoting and watch listings, capabilities not described by the snapshot-comparison purpose. They do not visibly perform the declared comparison. The chunk does not show watch creation, real-time price retrieval, or automatic repricing, so those behaviors are not inferred.
The supplied commands concern ARI watch functionality and its pricing, not the declared evidence-based comparison of ASIN price snapshots. This is a material capability mismatch. The snippet does not establish that scheduled monitoring is actually activated, so no claim is made that it starts recurring refreshes or performs automatic repricing.
The supplied command targets alerts, a capability not represented by the declared snapshot-only purpose. The underlying script is unavailable, so the evidence does not establish whether this command retrieves, creates, or manages alerts, nor whether it accesses live prices or changes external state. The mismatch is limited to the visible alert-related operation.
The standard workflow directs the agent to run VOC without first quoting and expressly permits charging before discussing the cost. This conflicts with both the advertised snapshot-only scope and the final explicit-confirmation requirement, creating a concrete unintended-spending risk.
The CLI implements persistent, billable watch creation and resumption beyond the advertised snapshot-comparison task. Price acceptance provides some protection, but command availability depends on an unprovided skill-defaults.json whitelist that fails open when absent or malformed; server-side consent enforcement cannot be verified here.
run_analysis changes an absent confirmation into approval when the remote quote contains a truthy autoConfirm value, then executes billable analysis. This contradicts the documented explicit --confirm requirement and can also turn deepdive's purported quote-only fallback into paid execution if these commands are allowed.
The reported range does not locate the relevant implementation, but cmd_autoconfirm does issue an account-wide PUT that can relax paid-operation confirmation requirements. This exceeds snapshot-comparison scope and has no separate consent gate; exploitability through the CLI depends on the unavailable command whitelist.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 重新发布：各市场首批上架的 1.5.0 包早于免确认修复，新注册的免费版用户仍会被要求先确认报价。
1.5.1 与当前官网下发的修复版一致，市场侧以新版本号覆盖旧包。
- 免确认只认服务端报价返回的 `autoConfirm`；采集报价扣除首次采集免费页；
非美国站首次采集可用赠送积点时不再提示「赠送积点不可用」（行为与修复后的 1.5.0 相同）。
- 命令、字段与计费规则不变，不提高最低支持版本。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 行为变更：新用户（注册并验证邮箱后）第一次要 VOC，只给 ASIN 即可（站点默认美国站），
`voc` 直接执行——自动补采集（默认 3 页）、生成报告、按服务端定价扣费并归档，
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
| `watch digest` | product-operations/watch-digest（GET） | 否；`creditsUsed` = 窗口内已确认的刷新扣点 |
| `watch events` | product-operations/events（GET） | 否；读取确定性变化事件 |
| `watch series` | product-operations/watches/{id}/series（GET） | 否；价格 / BSR / 评分日序列（1.5.2） |
| `analyze` | analysis/voc·keywords·insight·trend·variant·compare | 是；`--confirm` 或服务端 autoConfirm 命中 |
| `autoconfirm [N\|off\|default]` | user/autoconfirm（GET/PUT） | 否；设置免确认阈值（1.4.5） |
| `deepdive` | products + charts + reviews + reports + VOC quote/analysis | 默认否；`--confirm` 才分析 |
| `reports` / `report` | reports | 否 |
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
先调用 `quote --type ...`。报价字段：
`type, basePrice, price, sampledReviews, totalReviews, balance, sufficient`，
另有（1.4.5 起，1.5.0 调整）：`autoConfirm`（true = 服务端策略允许免确认直接生成）、
`autoConfirmRemaining`（还剩几次免确认，仅供转述）、`autoConfirmNote`（本次免确认说明，仅供转述）、
`webUrl`（该产品的网页报告页）。**是否直接生成只看 `autoConfirm`**，不要从 note 文案或 remaining 推断。
1.5.0 起服务端对前几次付费生成不看 `autoConfirmMaxCredits`，该字段**不再作为首次体验的硬拦截**，
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
为 true 时赠送积点计入 `nonUsCollectCredits`、`siteNote` 为空；UK/DE/JP 卖家的第一份 VOC 同样一步直出。
- 余额不足仍在执行前拦截（402）并引导充值；定价以服务端配置为准，代码常量仅为兜底。
- 一致性：`analyze` 各类型（insight / keywords / trend / variant / compare）走同一口径，
`autoConfirm=true` 即直接生成并返回 `charges`。
- 文档：移除所有写死的单价与合计示例。采集/分析单价与页数由后台 `pricing` 配置决定，
一律以本次报价返回的 `credits` / `totalCredits` 为准，不得凭文档或记忆报数。