Security audit
Security checks for vulnerabilities and agentic risk
This product-comparison skill needs review because it exposes broader account controls and can spend credits during operations described as previews.
Prefer a corrected release that restricts commands to differentiation analysis and guarantees previews cannot spend credits. If using this version, set ARI to ask before every charge, use quote or operations quote for previews, and explicitly request one-time manual collection. The evidence supports review for spending and scope controls, without establishing malicious intent.
scripts/ari.pyQuote-only deepdive can execute paid analysis without confirmation
Account credits can be consumed when the caller expected only a preview. The missing-subscription branch can also incorrectly claim that analysis was downgraded to a quote without charging.
scripts/ari.pyRecurring collection changes lack an executable confirmation gate
A direct Agent invocation can enable recurring collection and subsequent credit deductions without a technically enforced approval step.
The body instructs broader account operations, spending-policy changes, and potentially automatic paid analysis despite a differentiation-only description. The final fixed-entry section requires explicit confirmation and limits the workflow, but contradictory earlier directions leave an ambiguous authorization boundary and can lead an agent into unintended spending or account changes.
Weekly collection introduces recurring charges beyond the declared differentiation-only task, and collect defaults to weekly scheduling for new products. The instructions require manual scheduling when recurrence is not authorized, but this safeguard depends on agent interpretation within a document containing conflicting workflows.
Creating or resuming scheduled monitoring expands this positioning skill into persistent financial account management. Required quotes and explicit acceptance reduce the risk, but these commands should not be reachable through an entry point that separately claims to execute only differentiation analysis.
Persistent monitoring creation and modification exceed the specialized differentiation entry point and can produce ongoing charges. Explicit quote and consent requirements substantially mitigate the danger, but including these executable workflows alongside a conflicting differentiation-only restriction creates avoidable scope and authorization ambiguity.
This duplicates the monitoring scope-expansion issue: watch mutations create persistent financial obligations outside differentiation analysis. The file requires explicit price acceptance and user consent, so it does not establish silent enrollment, but its contradictory workflow scope remains a meaningful control weakness.
The supplied commands concern watch-service pricing and watch inventory rather than analyzing product evidence for differentiation. These are distinct, undeclared capabilities, with no visible connection to supporting the stated positioning workflow. The chunk does not show watch creation or modification.
所示命令以整个 Kitchen 类目为查询范围，未体现主 ASIN 或已授权竞品的范围限制，其直接功能是类目排行榜查询，超出了声明中的指定商品定位分析。由于未提供 scripts/ari.py 的实现，无法确认其具体数据访问、输出或 --confirm 的效果，也没有依据认定它执行了销量、广告或订单决策。
The supplied command targets alerts rather than the declared analysis of product, image, and review evidence. No connection is shown that would establish alerts as a supporting implementation detail of that analysis. The mismatch is limited to the visible command; the code does not establish whether it retrieves, creates, or modifies alerts, or accesses any particular external resource.
The supplied commands expose watch-monitoring and historical reporting capabilities that the description does not declare or connect to product-positioning evidence analysis. The underlying script is not supplied, so the snippet does not establish what metrics are monitored, whether competitor authorization is enforced, or whether any prohibited commercial decisions are supported.
The supplied commands expose watch-service administration and cost estimation rather than the declared evidence-based product-positioning analysis. The description does not disclose watch listing or recurring-refresh quoting. The chunk does not demonstrate that monitoring is started, nor does it establish access to sales, inventory, advertising, or order data.
The skill explicitly excludes advertising decisions yet directs keyword analysis, PPC grouping, negative-keyword suggestions, and proactive promotion of advertising uses. These conflicting instructions can cause users to receive operational advertising recommendations under the assurance of a positioning-only scope, although no direct ad-account mutation is shown.
run_analysis changes an absent confirmation into authorization based on a server-returned autoConfirm value, and cmd_voc uses the same mechanism to authorize collection plus analysis. Consequently, an invocation expected to return a quote can consume credits without the explicit --confirm promised by the module; any existing account-level consent is not independently established by this client.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 重新发布：各市场首批上架的 1.5.0 包早于免确认修复，新注册的免费版用户仍会被要求先确认报价。
1.5.1 与当前官网下发的修复版一致，市场侧以新版本号覆盖旧包。
- 免确认只认服务端报价返回的 `autoConfirm`；采集报价扣除首次采集免费页；
非美国站首次采集可用赠送积点时不再提示「赠送积点不可用」（行为与修复后的 1.5.0 相同）。
- 命令、字段与计费规则不变，不提高最低支持版本。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 行为变更：新用户（注册并验证邮箱后）第一次要 VOC，只给 ASIN 即可（站点默认美国站），
`voc` 直接执行——自动补采集（默认 3 页）、生成报告、按服务端定价扣费并归档，
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
不再停在报价等确认。费用在报告返回的 `charges` 字段透明展示（采集/分析/合计/余额前后）。
- 免确认与否**只认服务端报价返回的 `autoConfirm` 布尔**：服务端策略前 N 次付费生成不看金额上限
（新用户赠送积点按设计覆盖「3 页采集 + 一份 VOC」）；用户自设阈值优先、显式要求「每次先问」
时仍先报价；余额不足不自动。客户端不再从 `autoConfirmNote` 文案或 `autoConfirmRemaining`
自行推断——文案匹配会把 Free 小额提示里的「先确认」误判成用户要求每次询问，恰好挡住新用户。
- 采集报价同口径扣除服务端 `trialFreePages`（首次采集试用免费页），避免新用户被误报「积点不足」。
- 非美国站：服务端 `credits.gift` 策略下用户首次采集不限站点，`credits/balance` 返回 `giftAllSites`，
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
先调用 `quote --type ...`。报价字段：
`type, basePrice, price, sampledReviews, totalReviews, balance, sufficient`，
另有（1.4.5 起，1.5.0 调整）：`autoConfirm`（true = 服务端策略允许免确认直接生成）、
`autoConfirmRemaining`（还剩几次免确认，仅供转述）、`autoConfirmNote`（本次免确认说明，仅供转述）、
`webUrl`（该产品的网页报告页）。**是否直接生成只看 `autoConfirm`**，不要从 note 文案或 remaining 推断。
1.5.0 起服务端对前几次付费生成不看 `autoConfirmMaxCredits`，该字段**不再作为首次体验的硬拦截**，
只保留用户自设阈值与余额校验。`sampleCap` / `degraded` 表示 Free 样本封顶与轻量模型。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
先调用 `quote --type ...`。报价字段：
`type, basePrice, price, sampledReviews, totalReviews, balance, sufficient`，
另有（1.4.5 起，1.5.0 调整）：`autoConfirm`（true = 服务端策略允许免确认直接生成）、
`autoConfirmRemaining`（还剩几次免确认，仅供转述）、`autoConfirmNote`（本次免确认说明，仅供转述）、
`webUrl`（该产品的网页报告页）。**是否直接生成只看 `autoConfirm`**，不要从 note 文案或 remaining 推断。
1.5.0 起服务端对前几次付费生成不看 `autoConfirmMaxCredits`，该字段**不再作为首次体验的硬拦截**，
只保留用户自设阈值与余额校验。`sampleCap` / `degraded` 表示 Free 样本封顶与轻量模型。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
为 true 时赠送积点计入 `nonUsCollectCredits`、`siteNote` 为空；UK/DE/JP 卖家的第一份 VOC 同样一步直出。
- 余额不足仍在执行前拦截（402）并引导充值；定价以服务端配置为准，代码常量仅为兜底。
- 一致性：`analyze` 各类型（insight / keywords / trend / variant / compare）走同一口径，
`autoConfirm=true` 即直接生成并返回 `charges`。
- 文档：移除所有写死的单价与合计示例。采集/分析单价与页数由后台 `pricing` 配置决定，
一律以本次报价返回的 `credits` / `totalCredits` 为准，不得凭文档或记忆报数。
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 能力层收窄：44 个专属包不再只是「声明窄」，包体 `scripts/ari.py` 同时按各自契约裁剪。
构建期用 AST 删除文档未承诺的命令、它们的解析器注册块，以及只被它们引用的辅助函数与
常量；专属包因此不再包含 `export`（任意路径写文件）、`autoconfirm`（撤销逐次确认）、
`workbench`（改写差评处理状态）、`alerts`（标记预警已读）、`competitors`、`schedule`、
`voc` / `analyze` / `charts` / `deepdive` 等母版命令。
- 新增运行期兜底闸：专属包在包内写入 `allowedCommands` 白名单，`ari.py`
Without declared permissions the skill's intent is opaque and cannot be validated.
Server-defined first-use and remaining-use exemptions can trigger paid collection and analysis without a disclosed price or explicit spending authorization. User-configured thresholds can be legitimate delegation, but the text also permits first-use execution without an amount ceiling, contradicting the specialized entry point's mandatory confirmation rule.
`voc <ASIN>`（没说站点就用默认的美国站，不要为此追问）。
命中服务端免确认规则（新用户首次体验不看金额 / 账户剩余免确认次数 / 用户自设阈值）且余额充足时，
**直接完成采集 + 生成 + 扣点并归档**，不再停在报价环节。绝不能描述成“先帮你问个价 / 只报价不扣点”。
免确认与否以返回里的 `autoConfirm` 为准，不要自己从提示文案里猜。
- 直接生成成功后，返回结果带 `charges`（采集扣点、分析扣点、合计、扣前/扣后余额）与 `autoConfirmNote`。
**先讲报告，再用一句话转述实际扣点**，不要在拿到结果后再补问「要不要生成」，也不要回头补一次报价。
- 只有在返回 `confirmationRequired: true` 时（余额不足、或用户自行设置了“每次先问”）
A server-provided autoConfirm flag is treated as sufficient spending authorization even when it represents a provider-defined exemption rather than user consent. Reporting charges afterward does not repair that authorization gap, and the final explicit-confirmation requirement conflicts with this path.
命中服务端免确认规则（新用户首次体验不看金额 / 账户剩余免确认次数 / 用户自设阈值）且余额充足时，
**直接完成采集 + 生成 + 扣点并归档**，不再停在报价环节。绝不能描述成“先帮你问个价 / 只报价不扣点”。
免确认与否以返回里的 `autoConfirm` 为准，不要自己从提示文案里猜。
- 直接生成成功后，返回结果带 `charges`（采集扣点、分析扣点、合计、扣前/扣后余额）与 `autoConfirmNote`。
**先讲报告，再用一句话转述实际扣点**，不要在拿到结果后再补问「要不要生成」，也不要回头补一次报价。
- 只有在返回 `confirmationRequired: true` 时（余额不足、或用户自行设置了“每次先问”）
才报出 `totalCredits` 与余额并等待同意，同意后追加 `--confirm`。
The workflow tells the agent to run a potentially charging VOC command before obtaining a quote, with first-use spending explained only after the report exists. This can consume credits for a general analysis request without an informed price authorization and conflicts with the specialized quote-first workflow.
1. 运行 `check`，确认账户、邮箱验证状态和可用积点。
2. 用户要 VOC / 评论分析报告时，默认运行 `voc <ASIN> --site <站点>`，**不要再先跑一次报价**。
**返回里有 `autoConfirmed: true`（或直接带 `reportId` / 正文）就说明报告已经生成并扣点了**
（1.5.0：新用户首次体验直接出结果，用户先拿到报告再谈钱）。
此时把报告讲给用户，并转述 `charges` — 本次采集扣了多少、分析扣了多少、合计多少、扣后还剩多少。
**不要在拿到结果后再补问「要不要生成」，也不要再回头补一次报价。**
The instruction explicitly permits new-user paid generation without an amount ceiling based only on server auto-confirmation. A request for a report or an ASIN does not by itself establish authorization for an undisclosed credit cost, especially when the specialized workflow promises explicit confirmation.
- **价格一律以服务端本次报价为准**（`analysis/quote` 与 `collect` 报价返回的 `credits` /
`totalCredits`）。文档与示例里出现的任何单价、页数、合计都只是演示，后台可调，
**不要凭记忆或旧文档报数，也不要把示例价当成承诺价。**
- 报价返回 `autoConfirm: true` 时直接生成，不要再问「要不要」。
生成后一句话交代本次实际扣了多少、扣后余额（读 `charges` 字段）。
1.5.0 起服务端对新用户前几次付费生成不看金额上限：新用户验证邮箱后只给一个 ASIN，就一次性出报告。
- 用户说「以后别问了 / 50 以内直接做」→ 运行 `autoconfirm 50`；说「以后每次先问我」→ `autoconfirm off`；