Security audit
Security checks for vulnerabilities and agentic risk
Review is needed because commands presented as quotes can spend credits, and combined charges may exceed your automatic-spending limit.
If you install it, set autoconfirm off before generating reports and approve collection plus analysis costs together. Use quote for free estimates; omitting --confirm does not reliably prevent spending. Keep collection manual unless you approve recurring fees, and require fresh approval for unanswered quotes.
scripts/ari.pyQuote-only deepdive can invoke paid analysis without explicit confirmation
The CLI sends a paid VOC analysis request despite deepdive's documented explicit-confirmation requirement. The same helper can override the intended quote-only fallback when no main-product subscription is found.
scripts/ari.pyVOC auto-confirmation does not enforce the user's limit against combined collection and analysis costs
The CLI can automatically submit collection and analysis charges whose combined cost exceeds the user's chosen confirmation threshold.
The description understates financially consequential functionality, and the body permits default first-run charging without first presenting the price or establishing a user-selected spending limit. The mismatch matters because a request for an insight report can trigger credit consumption beyond what the activation description communicates; the explicitly authorized watch-management features are not independently vulnerabilities.
Competitor and review data can support consumer-insight reports, but persistent scheduled monitoring and its lifecycle and pricing controls are materially broader capabilities than the declared report-generation purpose. The supplied chunk documents commands rather than demonstrating their execution, so it does not establish that watches were actually created or charges incurred.
Competitor analysis can support consumer research, but persistent monitoring with schedules, lifecycle management, and price acceptance is a materially broader capability than generating evidence-backed insight reports. The description does not disclose these ongoing monitoring and pricing-related operations. This finding is based on the exposed commands; the underlying Python implementation was not supplied.
消费者洞察报告可以涉及竞品分析，但声明未披露持续监控、周期性调度及相关价格接受操作。这些是具有独立生命周期和潜在费用影响的能力，而非单纯生成报告的实现细节。该片段仅展示命令调用，无法确认其内部执行或实际扣费行为，但已足以识别所暴露能力与声明之间的差异。
Collecting review evidence can support consumer-insight reporting, but configuring persistent weekly monitoring with potential ongoing charges is an additional operational capability not disclosed in the description. This assessment is based on the supplied commands and comments; the implementation of scripts/ari.py is not shown.
The declared purpose concerns consumer research and report generation, whereas the supplied commands concern recurring-watch management and pricing, a distinct capability not disclosed in the description. The snippet does not show review analysis or report generation. Since the implementation of scripts/ari.py is not provided, this assessment is limited to the visible commands and their annotations.
The supplied commands expose watch-monitoring functionality rather than the declared review-grounded consumer-research reporting workflow. Although monitoring data could support research, the chunk provides no connection between these watch operations and the promised reports. This assessment is limited to the visible commands; the implementation of scripts/ari.py is not supplied.
The declared purpose describes consumer research and report generation, not recurring monitoring or inspection of watch-service pricing and existing watches. These commands expose a distinct, undeclared watch-service capability rather than directly supporting the described report workflow. The excerpt does not establish that watches are created, modified, or billed.
竞品绑定和趋势对比可以作为消费者洞察的辅助步骤，本身不构成明显不符；但按周自动采集引入了未声明的持续监测行为，而不仅是为当前报告读取或分析数据。该判断依据所示命令及其注释；未提供 ari.py 实现，无法验证自动采集的具体机制或范围。
The only visible operation selects the alerts subcommand, which is materially different from the declared report-generation workflow and is not shown to be a supporting implementation detail. The implementation of ari.py is unavailable, so the exact alert behavior, resource access, and side effects cannot be established.
The skill explicitly directs the agent to resume an unanswered quote in a later conversation and generate the report if automatic confirmation applies. An idle product records prior interest, not current authorization, so unrelated future interactions can trigger unwanted spending.
run_analysis converts an absent --confirm into authorization when the server returns a truthy autoConfirm value; cmd_voc similarly permits collection and analysis without explicit confirmation. This contradicts the documented confirmation boundary and lets quote-like agent calls, including deepdive, consume account credits without a local record of consent; server-side user preferences may mitigate this but are not verified here.
In context, the server's autoConfirm flag permits chargeable operations without first obtaining transaction-specific confirmation, including default introductory operations without an amount cap. This documents a financial-consent weakness rather than proving a runtime exploit; honoring explicit user limits mitigates it but does not establish consent for default spending.
- 重新发布：各市场首批上架的 1.5.0 包早于免确认修复，新注册的免费版用户仍会被要求先确认报价。
1.5.1 与当前官网下发的修复版一致，市场侧以新版本号覆盖旧包。
- 免确认只认服务端报价返回的 `autoConfirm`；采集报价扣除首次采集免费页；
非美国站首次采集可用赠送积点时不再提示「赠送积点不可用」（行为与修复后的 1.5.0 相同）。
- 命令、字段与计费规则不变，不提高最低支持版本。
The changelog explicitly describes automatically collecting data, generating a report, and deducting credits without a quote-confirmation step, with no amount cap for the first N paid generations. A generic report request can therefore consume credits without informed cost approval; reporting charges afterward and checking the available balance do not replace spending authorization.
- 行为变更：新用户（注册并验证邮箱后）第一次要 VOC，只给 ASIN 即可（站点默认美国站），
`voc` 直接执行——自动补采集（默认 3 页）、生成报告、按服务端定价扣费并归档，
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
This extends the same automatic charging policy to multiple analysis types: autoConfirm=true causes immediate generation, with charges disclosed afterward. In a consumer-insight workflow, analysis is expected, but permission to analyze does not necessarily authorize an undisclosed deduction of credits.
为 true 时赠送积点计入 `nonUsCollectCredits`、`siteNote` 为空；UK/DE/JP 卖家的第一份 VOC 同样一步直出。
- 余额不足仍在执行前拦截（402）并引导充值；定价以服务端配置为准，代码常量仅为兜底。
- 一致性：`analyze` 各类型（insight / keywords / trend / variant / compare）走同一口径，
`autoConfirm=true` 即直接生成并返回 `charges`。
- 文档：移除所有写死的单价与合计示例。采集/分析单价与页数由后台 `pricing` 配置决定，
一律以本次报价返回的 `credits` / `totalCredits` 为准，不得凭文档或记忆报数。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 能力层收窄：44 个专属包不再只是「声明窄」，包体 `scripts/ari.py` 同时按各自契约裁剪。
构建期用 AST 删除文档未承诺的命令、它们的解析器注册块，以及只被它们引用的辅助函数与
常量；专属包因此不再包含 `export`（任意路径写文件）、`autoconfirm`（撤销逐次确认）、
`workbench`（改写差评处理状态）、`alerts`（标记预警已读）、`competitors`、`schedule`、
`voc` / `analyze` / `charts` / `deepdive` 等母版命令。
- 新增运行期兜底闸：专属包在包内写入 `allowedCommands` 白名单，`ari.py`
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
def cmd_autoconfirm(args):
"""免确认阈值：不带参数=查看；`autoconfirm 50`=50 积点以内不问；`autoconfirm off`=每次都问；`autoconfirm default`=恢复默认。"""
value = (args.value or "").strip().lower()
if value:
if value in ("off", "ask", "0"):
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
def cmd_autoconfirm(args):
"""免确认阈值：不带参数=查看；`autoconfirm 50`=50 积点以内不问；`autoconfirm off`=每次都问；`autoconfirm default`=恢复默认。"""
value = (args.value or "").strip().lower()
if value:
if value in ("off", "ask", "0"):
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
def cmd_autoconfirm(args):
"""免确认阈值：不带参数=查看；`autoconfirm 50`=50 积点以内不问；`autoconfirm off`=每次都问；`autoconfirm default`=恢复默认。"""
value = (args.value or "").strip().lower()
if value:
if value in ("off", "ask", "0"):
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
return
out = request_json("PUT", "/api/v1/user/autoconfirm", {"limit": limit})
else:
out = request_json("GET", "/api/v1/user/autoconfirm")
if ok(out) and isinstance(data_of(out), dict):
d = data_of(out)
d["note"] = AUTOCONFIRM_MODE_NOTE.get(d.get("mode"), AUTOCONFIRM_MODE_NOTE["ask"]).format(
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
p = sub.add_parser("check", parents=[common], help="验证 Key、账户和积点余额")
p.set_defaults(fn=cmd_check)
p = sub.add_parser("autoconfirm", parents=[common],
help="免确认阈值：autoconfirm 50 / autoconfirm off / autoconfirm default；不带参数查看")
p.add_argument("value", nargs="?", default="")
p.set_defaults(fn=cmd_autoconfirm)
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
p.set_defaults(fn=cmd_check)
p = sub.add_parser("autoconfirm", parents=[common],
help="免确认阈值：autoconfirm 50 / autoconfirm off / autoconfirm default；不带参数查看")
p.add_argument("value", nargs="?", default="")
p.set_defaults(fn=cmd_autoconfirm)
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
p.set_defaults(fn=cmd_check)
p = sub.add_parser("autoconfirm", parents=[common],
help="免确认阈值：autoconfirm 50 / autoconfirm off / autoconfirm default；不带参数查看")
p.add_argument("value", nargs="?", default="")
p.set_defaults(fn=cmd_autoconfirm)