亚马逊竞品评论分析 · 对手短板拆解

• Outcome: Review
• Latest audit: Oct 27, 2026 · 8:25 AM UTC
• Version: 1.5.3

Overview

This skill can spend your ARI credits without fresh approval, including through a command documented as quote-only.

Review the billing behavior before installing. Set the account to always ask before spending, use the explicit quote command for prices, and do not treat an omitted --confirm flag as a guarantee against charges. Request a fix for deepdive and automatic execution of unanswered quotes. For one-time collection, specify manual scheduling; ongoing monitors require separate approval.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/ari.py

Finding

Documented quote-only deepdive can execute paid analysis

Content

View full analysis

Impact

The user's ARI credits can be consumed without the command-specific confirmation promised by references/reference.md:79. When no main-product subscription is found, the same helper can defeat the intended quote-only downgrade documented at references/reference.md:270-271; with --confirm supplied, the resulting productNote can additionally claim no charge despite execution.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (82)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The core review-analysis functionality matches the description, and API authentication, configuration storage, report retrieval, and exports are reasonable supporting details. However, persistent monitoring with recurring charges, account-level spending-policy changes, and operational review-management workflows materially expand the skill beyond competitor-review analysis. The supplied code registers these commands. An optional allowedCommands configuration could restrict their availability, but that configuration was not supplied, and the code imposes no restriction when it is absent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

Review digests and historical comparisons are consistent with competitor analysis. However, managing ongoing weekly watches and accepting recurring refresh pricing materially extends the declared batch-analysis and reporting purpose. The supplied chunk shows monitoring commands rather than the advertised batch review collection and comparison workflow; it does not expose the underlying CLI implementation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

Although monitoring competitor ASINs is related to competitive analysis, managing persistent scheduled watches and accepting per-refresh pricing materially extends the declared batch-analysis workflow. The description does not disclose recurring monitoring or its pricing implications. The supplied chunk contains command examples rather than the underlying implementation, so it does not establish that charges actually occur or what data the watches collect.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

Competitor ASIN tracking is related to the declared analysis purpose, but ongoing scheduled watches with per-refresh pricing introduce a materially undeclared operational capability and potential recurring cost. The excerpt shows watch-management commands rather than review collection, comparison, or report generation. Because it contains usage examples rather than the implementation of ari.py, it does not establish whether billing or data collection actually occurs.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence

Finding

Review collection is consistent with the declared purpose, but configuring ongoing, potentially billable monitoring extends beyond the described batch collection and competitor analysis. This changes future execution and spending behavior rather than merely implementing the stated analysis. The supplied chunk shows CLI invocations only; the underlying scheduler implementation is not provided.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 86% confidence

Finding

The supplied commands expose watch-monitoring functionality that is not declared in the review-collection and competitive-analysis description. Although monitoring could support competitor research, these commands concern monitoring availability, costs, and existing watches rather than the stated batch-review workflow. The snippet does not show creation or modification of watches.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 82% confidence

Finding

The supplied commands expose watch-management and pricing functionality rather than the declared review collection, comparison, and reporting capabilities. Although monitoring could support competitor research, this distinct functionality is not disclosed in the description. The CLI implementation is not supplied, so the snippet does not establish that these commands enable monitoring, incur charges, or perform other side effects.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 77% confidence

Finding

The supplied command targets alerts rather than review collection, competitor comparison, or report generation. This indicates an undeclared capability. Confidence is limited because the implementation of the alerts subcommand is unavailable; the snippet does not establish whether it retrieves, configures, or otherwise processes alerts.

Content

No source excerpt is available for this finding.

Converts an unanswered quote into paid execution during a later conversation without renewed user authorization.

High

• Category: Prompt Injection
• Confidence: 99% confidence

Finding

The skill explicitly turns an unanswered quote from a previous conversation into execution when an idle product is encountered later. Silence and a stored idle product do not authorize spending, and server-side auto-confirm defaults can allow credits to be consumed without any renewed request.

Content

No source excerpt is available for this finding.

Paid analysis and collection can execute without the explicit --confirm flag promised by the module documentation.

High

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

run_analysis converts an absent --confirm into authorization using the server's autoConfirm field, allowing a nominal preview invocation to spend credits. cmd_voc similarly permits collection and analysis without explicit confirmation, and deepdive inherits run_analysis behavior even where its output promises quotation only.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

This entry endorses server-controlled automatic confirmation, which the surrounding changelog describes as permitting initial paid operations without an amount cap or transaction-specific approval. That creates a financial-consent risk: an API response can authorize consumption of account credits rather than merely quote a price. This is evidence of a documented policy weakness, not proof that the competitor-review package exposes the affected commands.

Content

Scanner excerpt · CHANGELOG.md (reported line 23)May include surrounding context.

md

- 重新发布：各市场首批上架的 1.5.0 包早于免确认修复，新注册的免费版用户仍会被要求先确认报价。
  1.5.1 与当前官网下发的修复版一致，市场侧以新版本号覆盖旧包。
- 免确认只认服务端报价返回的 `autoConfirm`；采集报价扣除首次采集免费页；
  非美国站首次采集可用赠送积点时不再提示「赠送积点不可用」（行为与修复后的 1.5.0 相同）。
- 命令、字段与计费规则不变，不提高最低支持版本。

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The documented default permits the first N paid generations without an amount ceiling, automatically collecting data and deducting credits when the user supplies an ASIN. User-defined limits and insufficient-balance checks reduce exposure, but they do not establish informed spending authorization when no limit has been configured; reporting charges afterward is not prior consent. Actual execution in this specialized package remains unverified because only its changelog is supplied.

Content

Scanner excerpt · CHANGELOG.md (reported line 32)May include surrounding context.

md

- 行为变更：新用户（注册并验证邮箱后）第一次要 VOC，只给 ASIN 即可（站点默认美国站），
  `voc` 直接执行——自动补采集（默认 3 页）、生成报告、按服务端定价扣费并归档，
  不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
  （新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
  时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
  自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · CHANGELOG.md (reported line 34)May include surrounding context.

md

不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
  （新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
  时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
  自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · CHANGELOG.md (reported line 34)May include surrounding context.

md

不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
  （新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
  时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
  自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

This entry extends direct execution based on autoConfirm=true to multiple paid analysis types, propagating the same documented consent weakness rather than establishing a separate exploit. Balance checks limit losses to available credits but do not replace authorization to spend them. The older changelog also says specialized packages omit analyze, so reachability in this particular package needs verification.

Content

Scanner excerpt · CHANGELOG.md (reported line 41)May include surrounding context.

md

为 true 时赠送积点计入 `nonUsCollectCredits`、`siteNote` 为空；UK/DE/JP 卖家的第一份 VOC 同样一步直出。
- 余额不足仍在执行前拦截（402）并引导充值；定价以服务端配置为准，代码常量仅为兜底。
- 一致性：`analyze` 各类型（insight / keywords / trend / variant / compare）走同一口径，
  `autoConfirm=true` 即直接生成并返回 `charges`。
- 文档：移除所有写死的单价与合计示例。采集/分析单价与页数由后台 `pricing` 配置决定，
  一律以本次报价返回的 `credits` / `totalCredits` 为准，不得凭文档或记忆报数。

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · CHANGELOG.md (reported line 77)May include surrounding context.

md

- 能力层收窄：44 个专属包不再只是「声明窄」，包体 `scripts/ari.py` 同时按各自契约裁剪。
  构建期用 AST 删除文档未承诺的命令、它们的解析器注册块，以及只被它们引用的辅助函数与
  常量；专属包因此不再包含 `export`（任意路径写文件）、`autoconfirm`（撤销逐次确认）、
  `workbench`（改写差评处理状态）、`alerts`（标记预警已读）、`competitors`、`schedule`、
  `voc` / `analyze` / `charts` / `deepdive` 等母版命令。
- 新增运行期兜底闸：专属包在包内写入 `allowedCommands` 白名单，`ari.py`

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/ari.py (reported line 672)May include surrounding context.

python

limit = int(value)
            except ValueError:
                emit(error_obj("ARI_BAD_ARGUMENT", 0, "参数不对",
                               "用法：autoconfirm 50（50 积点以内不问）/ autoconfirm off（每次都问）/ autoconfirm default（恢复默认）"),
                     args.compact)
                return
        out = request_json("PUT", "/api/v1/user/autoconfirm", {"limit": limit})

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/ari.py (reported line 672)May include surrounding context.

python

limit = int(value)
            except ValueError:
                emit(error_obj("ARI_BAD_ARGUMENT", 0, "参数不对",
                               "用法：autoconfirm 50（50 积点以内不问）/ autoconfirm off（每次都问）/ autoconfirm default（恢复默认）"),
                     args.compact)
                return
        out = request_json("PUT", "/api/v1/user/autoconfirm", {"limit": limit})

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/ari.py (reported line 672)May include surrounding context.

python

limit = int(value)
            except ValueError:
                emit(error_obj("ARI_BAD_ARGUMENT", 0, "参数不对",
                               "用法：autoconfirm 50（50 积点以内不问）/ autoconfirm off（每次都问）/ autoconfirm default（恢复默认）"),
                     args.compact)
                return
        out = request_json("PUT", "/api/v1/user/autoconfirm", {"limit": limit})

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/ari.py (reported line 1890)May include surrounding context.

python

p = sub.add_parser("check", parents=[common], help="验证 Key、账户和积点余额")
    p.set_defaults(fn=cmd_check)

    p = sub.add_parser("autoconfirm", parents=[common],
                       help="免确认阈值：autoconfirm 50 / autoconfirm off / autoconfirm default；不带参数查看")
    p.add_argument("value", nargs="?", default="")
    p.set_defaults(fn=cmd_autoconfirm)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/ari.py (reported line 1893)May include surrounding context.

python

p = sub.add_parser("autoconfirm", parents=[common],
                       help="免确认阈值：autoconfirm 50 / autoconfirm off / autoconfirm default；不带参数查看")
    p.add_argument("value", nargs="?", default="")
    p.set_defaults(fn=cmd_autoconfirm)

    p = sub.add_parser("version", parents=[common], help="显示 Skill 版本与渠道（无需 Key）")
    p.set_defaults(fn=cmd_version)

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_write, network, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 98% confidence

Finding

The surrounding instructions permit collection and analysis charges under first-run or remaining-use exemptions that need not have a monetary limit. A service-provided autoConfirm flag establishes execution eligibility, not that the user knowingly authorized the price; post-charge disclosure does not supply that missing consent.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md

`voc <ASIN>`（没说站点就用默认的美国站，不要为此追问）。
  命中服务端免确认规则（新用户首次体验不看金额 / 账户剩余免确认次数 / 用户自设阈值）且余额充足时，
  **直接完成采集 + 生成 + 扣点并归档**，不再停在报价环节。绝不能描述成“先帮你问个价 / 只报价不扣点”。
  免确认与否以返回里的 `autoConfirm` 为准，不要自己从提示文案里猜。
- 直接生成成功后，返回结果带 `charges`（采集扣点、分析扣点、合计、扣前/扣后余额）与 `autoConfirmNote`。
  **先讲报告，再用一句话转述实际扣点**，不要在拿到结果后再补问「要不要生成」，也不要回头补一次报价。
- 只有在返回 `confirmationRequired: true` 时（余额不足、或用户自行设置了“每次先问”）

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 98% confidence

Finding

This occurrence makes the server's autoConfirm value the deciding authority for whether to ask before spending. Although explicit user-set thresholds can legitimately support automatic execution, the same path also accepts service-defined exemptions with no demonstrated user-approved amount.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md

命中服务端免确认规则（新用户首次体验不看金额 / 账户剩余免确认次数 / 用户自设阈值）且余额充足时，
  **直接完成采集 + 生成 + 扣点并归档**，不再停在报价环节。绝不能描述成“先帮你问个价 / 只报价不扣点”。
  免确认与否以返回里的 `autoConfirm` 为准，不要自己从提示文案里猜。
- 直接生成成功后，返回结果带 `charges`（采集扣点、分析扣点、合计、扣前/扣后余额）与 `autoConfirmNote`。
  **先讲报告，再用一句话转述实际扣点**，不要在拿到结果后再补问「要不要生成」，也不要回头补一次报价。
- 只有在返回 `confirmationRequired: true` 时（余额不足、或用户自行设置了“每次先问”）
  才报出 `totalCredits` 与余额并等待同意，同意后追加 `--confirm`。

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 98% confidence

Finding

The standard workflow explicitly skips a prior quote and invokes a command that may already have charged the account when it returns. This makes the authorization check occur too late for first-run users who have not approved a price or spending limit.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

md

1. 运行 `check`，确认账户、邮箱验证状态和可用积点。
2. 用户要 VOC / 评论分析报告时，默认运行 `voc <ASIN> --site <站点>`，**不要再先跑一次报价**。
   **返回里有 `autoConfirmed: true`（或直接带 `reportId` / 正文）就说明报告已经生成并扣点了**
   （1.5.0：新用户首次体验直接出结果，用户先拿到报告再谈钱）。
   此时把报告讲给用户，并转述 `charges` — 本次采集扣了多少、分析扣了多少、合计多少、扣后还剩多少。
   **不要在拿到结果后再补问「要不要生成」，也不要再回头补一次报价。**