Security audit
Security checks for vulnerabilities and agentic risk
This package promises approval before generating weekly reports but also permits automatic credit spending and broader recurring monitoring.
Prefer a corrected report-only package that consistently requires acceptance of the current total price. If using this version, disable account auto-confirmation, explicitly request manual collection, and review recurring schedules. Authorization saves a reusable ARI API key locally.
scripts/ari.pyQuote-only deepdive can execute paid analysis
Unexpected credit consumption and report generation during an operation represented as quotation-only.
scripts/ari.pyAnalysis-only auto-confirm authorization is reused for combined collection costs
Credits can be spent beyond the user's configured per-operation confirmation limit without requesting approval for the combined cost.
The document repeatedly directs paid VOC execution without prior quotation acceptance when server-side auto-confirmation applies, including default first-run rules without an amount limit. This conflicts with the specialized entry's explicit-confirmation requirement and creates an actionable path to unexpected credit consumption; the final restrictive section mitigates but does not eliminate the contradictory instructions.
The commands center on watch-monitoring outputs, not generating the declared weekly AI comparison report. A seven-day digest does not become the declared report merely because its period is weekly. The chunk also shows no confirmation or quotation gate, although the mismatch is primarily established by its monitoring-oriented operations. The snippet does not establish hourly monitoring, real-time data access, or access to sales, inventory, advertising, orders, or actual return rates.
所提供命令的直接用途是管理监控与自动采集调度，而不是生成对照周报。尤其是“设为每周自动采集”引入了持续运行的能力，与描述限定的“仅用于主动触发的 weekly AI 报告”不一致。代码片段未展示底层实现，因此不能据此断言其绕过确认、报价或 API 密钥验证。
The supplied command requests a category leaderboard, a materially different operation and scope from the declared weekly reporting workflow. It does not identify a main ASIN or authorized competitors. The --confirm flag does not resolve that purpose mismatch. The snippet does not establish what neg_rate measures, so it should not be treated as evidence of access to real return rates.
Weekly scheduling, competitor selection, and explicit price acceptance are consistent with parts of the description. However, the exposed interface also provides ongoing watch management and monitoring outputs, while the description restricts the skill to actively triggered weekly AI reports and excludes monitoring summaries. The chunk does not establish whether digests are free or whether sensitive operational metrics are accessed, so those additional violations cannot be inferred.
The supporting workflow goes beyond merely exposing alerts: it tells the agent to retrieve account-wide alerts automatically at session start and proactively disclose them. That needlessly brings unrelated account information into a conversation authorized for a particular competitor report, although no external exfiltration is shown.
Quoting and accepting a price could support the declared workflow, but the command set exposes a broader monitoring interface rather than just weekly AI report generation. In particular, watch digest, events, and series provide monitoring-oriented retrieval, while pause, resume, and delete manage persistent watches. The underlying Python implementation is not supplied, so API-key enforcement, billing behavior, and the exact contents of retrieved data cannot be verified; there is no evidence here of real-time price, sales, inventory, advertising, or order access.
The comparison workflow recommends competitor binding and states that binding starts weekly automatic collection, without a local step to quote and authorize that recurring side effect. Approval of a one-time comparison or use of an already authorized competitor does not necessarily authorize a new recurring collection relationship.
ASIN、竞品及接受报价参数与声明部分一致，但所示命令的直接功能是建立和管理周期性 watch，超出了“仅用于主动触发的 weekly AI 报告”的范围。该片段未展示报告生成或证据整合逻辑。由于未提供 scripts/ari.py 的实现，不能进一步断言它会采集实时价格、销量、库存等被排除的数据，也不能验证其是否检查竞品授权。
Quotation can support the declared reporting workflow, but the visible commands concern a broader watch service, including watch listing and nonweekly refresh schedules. Those capabilities are not represented by the narrowly scoped description. The underlying script is not supplied, so this finding is limited to the exposed command interface; it does not establish that live monitoring, real-time price access, or unauthorized data access actually occurs.
The supplied command targets an individual review through an advice subcommand, which does not match the stated purpose of producing weekly ASIN comparison reports. Although --confirm supplies a confirmation flag, the snippet does not demonstrate the described reporting workflow. The implementation of ari.py is not supplied, so downstream actions, external access, and side effects cannot be established.
The instruction to decide whether to generate solely from autoConfirm substitutes server policy for the explicit user approval required by this skill. The separate weekly operations workflow correctly requires confirmation, so this is conflicting guidance that could cause unauthorized charges through alternative analysis commands, not evidence that operations run itself bypasses confirmation.
The reference documents a collection command that defaults to recurring weekly collection unless manual scheduling is explicitly selected. In this explicitly on-demand skill, an agent using that default could authorize continuing collection charges beyond the requested report; the documented manual option mitigates but does not eliminate this scope-confusion risk.
run_analysis replaces an absent --confirm with approval derived from the server's autoConfirm field, then invokes a paid endpoint. cmd_voc similarly permits collection and analysis without presenting the combined quote for explicit approval, contradicting this skill's confirmation requirement and potentially consuming credits unexpectedly; command reachability depends on the unprovided skill-defaults.json.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 重新发布：各市场首批上架的 1.5.0 包早于免确认修复，新注册的免费版用户仍会被要求先确认报价。
1.5.1 与当前官网下发的修复版一致，市场侧以新版本号覆盖旧包。
- 免确认只认服务端报价返回的 `autoConfirm`；采集报价扣除首次采集免费页；
非美国站首次采集可用赠送积点时不再提示「赠送积点不可用」（行为与修复后的 1.5.0 相同）。
- 命令、字段与计费规则不变，不提高最低支持版本。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 行为变更：新用户（注册并验证邮箱后）第一次要 VOC，只给 ASIN 即可（站点默认美国站），
`voc` 直接执行——自动补采集（默认 3 页）、生成报告、按服务端定价扣费并归档，
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
另有（1.4.5 起，1.5.0 调整）：`autoConfirm`（true = 服务端策略允许免确认直接生成）、
`autoConfirmRemaining`（还剩几次免确认，仅供转述）、`autoConfirmNote`（本次免确认说明，仅供转述）、
`webUrl`（该产品的网页报告页）。**是否直接生成只看 `autoConfirm`**，不要从 note 文案或 remaining 推断。
1.5.0 起服务端对前几次付费生成不看 `autoConfirmMaxCredits`，该字段**不再作为首次体验的硬拦截**，
只保留用户自设阈值与余额校验。`sampleCap` / `degraded` 表示 Free 样本封顶与轻量模型。
`voc` / `analyze` 在 autoConfirm 命中时会直接生成，返回 `autoConfirmed: true`、
`charges`（collectionCredits / analysisCredits / totalCredits / balanceBefore / balanceAfter）与 `autoConfirmNote`，
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
为 true 时赠送积点计入 `nonUsCollectCredits`、`siteNote` 为空；UK/DE/JP 卖家的第一份 VOC 同样一步直出。
- 余额不足仍在执行前拦截（402）并引导充值；定价以服务端配置为准，代码常量仅为兜底。
- 一致性：`analyze` 各类型（insight / keywords / trend / variant / compare）走同一口径，
`autoConfirm=true` 即直接生成并返回 `charges`。
- 文档：移除所有写死的单价与合计示例。采集/分析单价与页数由后台 `pricing` 配置决定，
一律以本次报价返回的 `credits` / `totalCredits` 为准，不得凭文档或记忆报数。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
| `watch digest` | product-operations/watch-digest（GET） | 否；`creditsUsed` = 窗口内已确认的刷新扣点 |
| `watch events` | product-operations/events（GET） | 否；读取确定性变化事件 |
| `watch series` | product-operations/watches/{id}/series（GET） | 否；价格 / BSR / 评分日序列（1.5.2） |
| `analyze` | analysis/voc·keywords·insight·trend·variant·compare | 是；`--confirm` 或服务端 autoConfirm 命中 |
| `autoconfirm [N\|off\|default]` | user/autoconfirm（GET/PUT） | 否；设置免确认阈值（1.4.5） |
| `deepdive` | products + charts + reviews + reports + VOC quote/analysis | 默认否；`--confirm` 才分析 |
| `reports` / `report` | reports | 否 |
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 能力层收窄：44 个专属包不再只是「声明窄」，包体 `scripts/ari.py` 同时按各自契约裁剪。
构建期用 AST 删除文档未承诺的命令、它们的解析器注册块，以及只被它们引用的辅助函数与
常量；专属包因此不再包含 `export`（任意路径写文件）、`autoconfirm`（撤销逐次确认）、
`workbench`（改写差评处理状态）、`alerts`（标记预警已读）、`competitors`、`schedule`、
`voc` / `analyze` / `charts` / `deepdive` 等母版命令。
- 新增运行期兜底闸：专属包在包内写入 `allowedCommands` 白名单，`ari.py`
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
p = sub.add_parser("check", parents=[common], help="验证 Key、账户和积点余额")
p.set_defaults(fn=cmd_check)
p = sub.add_parser("autoconfirm", parents=[common],
help="免确认阈值：autoconfirm 50 / autoconfirm off / autoconfirm default；不带参数查看")
p.add_argument("value", nargs="?", default="")
p.set_defaults(fn=cmd_autoconfirm)
Without declared permissions the skill's intent is opaque and cannot be validated.
The instruction substitutes server auto-confirmation for the explicit quotation acceptance promised by this skill. A user-defined spending threshold could represent prior authorization, but default first-run allowances without an amount limit do not establish that the user accepted this particular charge.
`voc <ASIN>`（没说站点就用默认的美国站，不要为此追问）。
命中服务端免确认规则（新用户首次体验不看金额 / 账户剩余免确认次数 / 用户自设阈值）且余额充足时，
**直接完成采集 + 生成 + 扣点并归档**，不再停在报价环节。绝不能描述成“先帮你问个价 / 只报价不扣点”。
免确认与否以返回里的 `autoConfirm` 为准，不要自己从提示文案里猜。
- 直接生成成功后，返回结果带 `charges`（采集扣点、分析扣点、合计、扣前/扣后余额）与 `autoConfirmNote`。
**先讲报告，再用一句话转述实际扣点**，不要在拿到结果后再补问「要不要生成」，也不要回头补一次报价。
- 只有在返回 `confirmationRequired: true` 时（余额不足、或用户自行设置了“每次先问”）